Borrowing it
Nothing to install: this file belongs to tool-bunker/code-buster. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/tool-bunker/code-buster/main/.agents/skills/code-buster-rule-development/SKILL.mdgit clone --depth 1 https://github.com/tool-bunker/code-busterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tool-bunker/code-buster/code-buster-rule-development)<a href="https://agentmods.dev/skills/tool-bunker/code-buster/code-buster-rule-development"><img src="https://agentmods.dev/badge/skills/tool-bunker/code-buster/code-buster-rule-development/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tool-bunker/code-buster/code-buster-rule-development"><img src="https://agentmods.dev/badge/skills/tool-bunker/code-buster/code-buster-rule-development.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.01221 |
| Opus 5.5 | $0.00016 | $0.00488 |
| Sonnet 5.5 | $0.00008 | $0.00244 |
| Haiku 4.5 | $0.00004 | $0.00122 |
Grade A, and why
code-buster-rule-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Buster rule development
Use this skill when changing detection, severity, taxonomy, confidence,
deduplication, source-role handling, safe-pattern handling, or reported
evidence. Run commands from the code-buster/ repository root.
Define the observable contract
Before editing, write down:
- the exact risky construct and why it matters;
- affected languages, versions, and frameworks;
- whether the result is actionable or advisory;
- the minimum semantic evidence and expected confidence;
- known safe and intentional forms;
- applicable production, test, generated, example, benchmark, and vendored roles;
- deduplication scope: occurrence, function, file, package, component, or repository;
- limitations that remain after implementation.
A token match is not automatically a defect. Prefer evidence from API boundaries, ownership, sinks, control flow, configuration, parsed structure, or framework conventions.
Research before editing
- Locate the owning analyzer, canonical JSON definition, execution pack, and focused tests.
- Use language-server references before changing exported symbols.
- Reuse
SourceAnalysisContext, lexical masks, source indexes, cached regular expressions, graph facts, and path classifiers. - Check whether the language already parses once and exposes a shared representation.
- Check how effective policy maps groups, taxonomy, advisory modes, baselines, and source roles.
- Run the current detector against the motivating source and inspect representative findings.
Fix the general semantic cause. Never add repository-name, repository-path, filename, or one-off source-text exceptions.
Choose the strongest available analysis
Prefer, in order:
- resolved language or framework semantics already exposed by an analyzer;
- parsed structure and ownership;
- token streams with established masking;
- conservative lexical evidence.
Do not replace available structured evidence with regular expressions. Define
fixed regular expressions in LazyLock, and avoid rescanning the same source
for every rule when a shared index can compute the evidence once.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago Changed · +2 lines · +1 tokens per session scan C → A 4365e3913375
- 29d ago First seen · 151 lines · 38 tokens per session scan C 39dc9e36ac94
code-buster-rule-development is a skill published in the GitHub repository tool-bunker/code-buster (86 stars, last pushed 3d ago), licensed MIT. It adds 39 tokens to every session and 1,221 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-28.
Other skills, from other repositories
roam
Codebase comprehension via roam-code CLI. Use when exploring codebases, planning modifications, debugging failures, assessing PR risk, or checking architecture health. Triggers on: understanding project structure, pre-change safety checks, finding symbols/files, blast radius analysis, affected tests, health scoring…
dekko-verify
Sanity-check a suspiciously low or zero call-graph result from dekko (getcallers, getcallees, findusages, impactedtests, unused) before concluding "no callers" or "dead code," or a heritage/throws-provenance result (query supertypes, query subtypes, query throws) that labels something (external) when you expect it to…
dekko-refactor
List every site a rename, move, or signature change must touch before editing, then prove nothing was missed after. Trigger when about to rename a function, method, class or type, rename or move a file or module, change a parameter list or return type, move a symbol between files, or remove a symbol, in a repo with a…
dekko-debug
Work a stack trace, exception, or error report from dekko's map instead of reading each frame's file. Trigger when given a traceback, an exception type or message, a failing test's error, or a question like "why does X raise", "who handles this error", "how does control get from A to B", or "where is this env var…
stuck
Diagnose frozen, stuck, or slow Qwen Code sessions on this machine. Scans for problematic processes, high CPU/memory usage, hung subprocesses, and debug logs. Use /stuck or /stuck to focus on a specific process.
structured-debugging
Hypothesis-driven debugging methodology for hard bugs. Use this skill whenever you're investigating non-trivial bugs, unexpected behavior, flaky tests, or tracing issues through complex systems. Activate proactively when debugging requires more than a quick glance — especially when the first attempt at a fix didn't…