Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add YSAA1/harness-workflow --skill diagnosegit clone --depth 1 https://github.com/YSAA1/harness-workflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ysaa1/harness-workflow/diagnose)<a href="https://agentmods.dev/skills/ysaa1/harness-workflow/diagnose"><img src="https://agentmods.dev/badge/skills/ysaa1/harness-workflow/diagnose/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ysaa1/harness-workflow/diagnose"><img src="https://agentmods.dev/badge/skills/ysaa1/harness-workflow/diagnose.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.01450 |
| Opus 5.5 | $0.00023 | $0.00580 |
| Sonnet 5.5 | $0.00011 | $0.00290 |
| Haiku 4.5 | $0.00006 | $0.00145 |
Grade A, and why
diagnose scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
2. **Build a feedback loop first (gate)**: before proposing any root-cause hypothesis, have **one command** (a test invocation, a script path, a curl, ...) that you have **already run at least once** (show the invocation How it starts
The opening of the file, as written. The whole thing — 39 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Evidence-based diagnosis
Map the user-described failure onto the real environment, distinguishing symptoms, hypotheses, confirmed causes, and fix evidence. Do not pass off a fix by hiding errors, skipping tests, or widening fault tolerance. Skip a phase only with an explicit reason.
Process
- Capture the scene and redact: capture the relevant commands, cwd, environment, exit codes, logs, inputs, and recent changes. Before showing anything, write secrets as
<REDACTED>; credentials used by the loop travel through environment variables, never through what you show; quote only the lines of captured artifacts that carry the signal. - Build a feedback loop first (gate): before proposing any root-cause hypothesis, have one command (a test invocation, a script path, a curl, ...) that you have already run at least once (show the invocation and its redacted output), and that is:
- Red-capable: it drives the real failure path and asserts the user's original symptom, going green once fixed. "Ran without erroring" does not count;
- Deterministic: the same verdict every run; for intermittent failures aim for a higher reproduction rate (loop the trigger, parallelise, add stress, narrow timing windows), not a clean repro;
- Fast: seconds, not minutes;
- Agent-runnable unattended: when a human must take part, drive them with a structured script whose output flows back.
Once you have a loop, treat it as a product: faster, sharper signal, more deterministic. The menu of ways to build one is in
references/feedback-loops.md. Reading code to find a seam and build the loop is fine; if you catch yourself reading code to build a root-cause theory before the loop exists, stop: that is exactly the failure this gate prevents. Exemption: when expensive GPU, production, destructive, or external environments genuinely cannot yield a loop, or the user authorized a read-only diagnosis (no new scripts/tests) and no existing command can serve as the loop, state the means you tried and the gap (environment access, a redacted captured artifact such as logs/HAR/core dump, permission for temporary instrumentation) and ask the user for it; you may keep reasoning from existing logs, source, and configuration, but every conclusion is labelled "unverified hypothesis" and no fix may be claimed as verified. Expensive tasks are not re-run just to satisfy a count.
- Reproduce and minimise: run the loop and watch it go red; confirm it is the symptom the user described, not a nearby failure (wrong bug = wrong fix). Then cut inputs, callers, config, data, and steps one at a time, re-running after each cut, until every remaining element is load-bearing (removing any one turns it green).
- Rank falsifiable hypotheses: before testing, list several candidates and rank them, rather than anchoring on the first plausible idea; no fixed count is enforced. Each states its prediction: "If X is the cause, then changing Y makes the failure disappear / changing Z makes it worse"; one with no statable prediction is a vibe: discard or sharpen it. Show the ranked list to the user (they often hold domain knowledge that re-ranks it instantly), but do not block on it.
- Targeted instrumentation: each probe maps to one prediction, changing one variable at a time; independent read-only checks may run in parallel. Prefer a debugger/REPL, then logs at the boundaries that discriminate hypotheses; never "log everything and grep". Tag every debug log with a unique prefix (e.g.
[DEBUG-a4f2]) so cleanup is a single grep. For performance, establish a baseline measurement and then bisect: measure first, fix second. - Fix and regression test: at a correct seam (where the test reproduces the failure as it really occurs at the call site), turn the minimised repro into a failing test → watch it go red (if you forced the red by mutating code or a fixture, diff against a pristine copy to prove the mutation landed before trusting it) → make the minimal fix within the authorized scope → watch it go green → re-run the step-2 loop against the original, un-minimised scenario. When only a too-shallow seam exists, do not force a regression test there (false confidence): the absence of a correct seam is itself a finding; record it in the report as an environment-improvement candidate for
cleanup. Do not fold adjacent unrelated failures into the same root cause. - Continue while information gain keeps coming and the budget holds. When there is no new evidence, external access is needed, or cost exceeds the authorization, state the specific gap; do not automatically declare a block after a fixed three rounds.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed · +9 lines · +12 tokens per session 3f21310d5985
- 1mo ago Changed · -4 tokens per session f9ad7db02059
- 1mo ago Changed faa1adc6a2b5
- 1mo ago Changed · -125 lines · -34 tokens per session 7aa22ddc28dd
- 1mo ago First seen · 155 lines · 83 tokens per session scan A df2f2ebd253c
diagnose is a skill published in the GitHub repository YSAA1/harness-workflow (3 stars, last pushed 16d ago), licensed MIT. It adds 57 tokens to every session and 1,450 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
diagnose-backend-bug
Diagnose a bounded backend or multi-service failure from GitHub Issues, Jira, Aone, user-provided exports, logs, traces, responses, stack traces, or job records. Use when a service, API, RPC, worker, queue, CLI, or scheduled job bug needs correlation through the project's existing observability route before repair; do…
reproduce-frontend-bug
Build a bounded, replayable browser or UI bug reproduction from GitHub Issues, Jira, Aone, user-provided exports, screenshots, videos, comments, or attachments. Use for browser, WebView, IDE or desktop UI, interaction, responsive, rendering, accessibility, or visual defects that need evidence-preserving reproduction…
comet-hotfix
Comet preset path: Bug fix / hotfix. Skip brainstorming, directly open → build → verify → archive. Applicable for behavior fixes, scenarios not involving new capability design.
kiro-verify-completion
Verify completion and success claims with fresh evidence. Use before claiming a task is complete, a fix works, tests pass, or a feature is ready for GO.
intent-correlation-analysis
Analyze a bounded IntentCorrelationPacketV1 and propose reviewable links among user inputs, execution slices, change units, commits, artifacts, and validation outcomes. Use when reconstructing why an observed coding-agent change exists or when Studio needs evidence-backed Intent correlation. Do not use for raw…
prismer-python-debugpy
Debug Python: pdb REPL + debugpy remote (DAP).