debug-error — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited debug-error (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Systematic approach to debugging errors and unexpected behavior. Works with any project.
BEFORE debugging, you MUST:
README.md (project overview)
src/[domain]/@_[domain]-README.md (domain-specific behavior)
docs/ (system documentation)If the error is from production and Sentry is configured, fetch the full context:
CallMcpTool(server: "plugin-sentry-sentry", toolName: "search_issues", arguments: {
"organizationSlug": "<ORG_SLUG>",
"naturalLanguageQuery": "<error message or description>",
"projectSlugOrId": "<PROJECT_SLUG>",
"regionUrl": "<REGION_URL>",
"limit": 5
})Then get details for the matching issue:
CallMcpTool(server: "plugin-sentry-sentry", toolName: "get_sentry_resource", arguments: {
"organizationSlug": "<ORG_SLUG>",
"resourceType": "issue",
"resourceId": "<ISSUE_ID>"
})Extract: stacktrace, breadcrumbs, tags (browser, OS, URL, release), event frequency.
If data is involved, verify expectations against reality using Supabase MCP or direct queries.
Before diving into debug, state:
"Pre-debug check:
- README/docs read: [list]
- Sentry context: [YES with details / NO — not production / not configured]
- Database state verified: [YES/NO — findings]
- Backend API checked: [YES/NO — status]
- Error scope identified: [FE only / BE only / Integration / Data]"1. Reproduce → 2. Isolate → 3. Research → 4. Identify → 5. Fix → 6. Verify → 7. PreventError Report:
- What happened: [description]
- Expected behavior: [what should happen]
- Steps to reproduce:
1. [step]
2. [step]
- Environment: [browser/OS/Node version]
- Error message: [exact message]
- Stack trace: [if available]
- First seen: [when — correlate with deploys]git log for recent changes)Works in: Fails in:
├─ Production? ├─ Production?
├─ Staging? ├─ Staging?
├─ Local? ├─ Local?
├─ All browsers? ├─ Specific browser?
├─ All users? ├─ Specific user?
└─ All data? └─ Specific data?For data-related bugs, trace the full pipeline:
User Action → Frontend Handler → API Call → Backend Controller → Database → Response → State Update → RenderIdentify where the data goes wrong by checking each boundary.
For non-trivial errors, research the correct fix before implementing:
CallMcpTool(server: "user-firecrawl", toolName: "firecrawl_search", arguments: {
"query": "<framework> <exact error message> fix best practice",
"limit": 5,
"sources": [{ "type": "web" }]
})Then scrape the most relevant result:
CallMcpTool(server: "user-firecrawl", toolName: "firecrawl_scrape", arguments: {
"url": "<best-result-url>",
"formats": ["markdown"],
"onlyMainContent": true
})Also check official docs via Context7 if the error relates to a library:
CallMcpTool(server: "context7", toolName: "resolve-library-id", arguments: {
"libraryName": "<library>",
"query": "<error description>"
})Trust hierarchy: Official docs > maintainer posts > engineering blogs > Stack Overflow (current year, high votes).
| Error | Likely Cause | First Check |
|---|---|---|
TypeError: Cannot read property 'x' of undefined | Null/undefined access | Where does the value come from? Fix the producer. |
ReferenceError: x is not defined | Variable not declared | Check imports, scope, circular dependencies |
SyntaxError | Invalid code | Check syntax, missing brackets, JSON parsing |
Network Error | API/connectivity | Check endpoint, CORS, auth, network tab |
CORS Error | Cross-origin blocked | Check server CORS config, proxy setup |
401 Unauthorized | Auth issue | Check token expiry, refresh logic, cookie settings |
404 Not Found | Wrong URL/missing resource | Check route definition, dynamic params, API path |
500 Internal Server Error | Server-side bug | Check server logs, not frontend code |
Unhandled Promise Rejection | Missing await or catch | Find the unhandled async chain |
Hydration mismatch | Server/client render differs | Check for browser-only APIs in SSR, dynamic content |
Before writing any fix, state:
Do NOT apply these as the sole fix:
?. to suppress a TypeError → fix why the value is null?? [] fallback → handle loading/error states explicitlyif guards at the consumer → fix the producer# Run tests
npm test
# Or framework-specific
pytest
cargo test
go test ./...If the bug could recur in a different form, add monitoring:
If the bug was caused by a non-obvious interaction, add a comment explaining the constraint:
// Profile can be null for users who haven't completed onboarding.
// The API returns null (not 404) in this case. See: ISSUE-123.## Bug Investigation: [Title]
**Pre-Debug:**
- [ ] Docs/README read
- [ ] Sentry context fetched (if applicable)
- [ ] Database state checked (if data-related)
- [ ] Error scope identified
**Investigation:**
- [ ] Can reproduce locally (or have Sentry reproduction)
- [ ] Isolated to specific component/function/layer
- [ ] Research completed (Firecrawl/Context7)
- [ ] Root cause identified and stated
**Fix:**
- [ ] Fix addresses root cause (not symptoms)
- [ ] No anti-patterns used as sole fix
- [ ] Side effects checked (other callers)
- [ ] Tests pass
**Prevention:**
- [ ] Monitoring added (if applicable)
- [ ] Documentation updated (if non-obvious)# Check recent changes to a file
git log --oneline -20 -- path/to/file.ts
# Find when a bug was introduced
git bisect start
git bisect bad HEAD
git bisect good <known-good-commit>
# Check what changed between two commits
git diff <commit1>..<commit2> -- path/to/file.ts
# Search for all usages of a function
rg "functionName" --type ts~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.