debug-error — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited debug-error (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Degree of freedom: MIXED. Root-cause judgment [HIGH freedom]; the red feedback loop and verify-green re-run [LOW freedom — run exactly].
Systematic approach to debugging errors and unexpected behavior. Works with any project.
| Skill | Owns |
|---|---|
| debug-error (this) | Diagnose one bug with hypotheses and runtime evidence before fixing |
debug-fe-be-integration | Frontend-backend contract failures traced on both sides: 4xx/5xx, mismatched payloads |
workflow-fix-and-ship | One bug-fix lifecycle: triage, reproduce, debug, regression test, fix, PR |
debug-sentry-monitor | Operate Sentry: triage unresolved issues, cut noise, monitor after deploy |
Observe:TypeError: Cannot read property 'email' of undefinedon/accountafter signup. Interpret: crash is in the profile card; API returnsnullfor incomplete onboarding. Classify: data bug — producer returns null, consumer assumes an object. Fix: handle the onboarding-null at the producer contract + UI empty state; do not?.the crash site only.
?. / swallowed catch as the sole fixdebug-fe-be-integration; Sentry backlog → debug-sentry-monitorBefore debugging:
README.md (project overview)
src/[domain]/@_[domain]-README.md (domain-specific behavior)
docs/ (system documentation)If the error is from production and Sentry is configured, fetch the full context:
sentry:search_issues
{
"organizationSlug": "<ORG_SLUG>",
"query": "<error message or description>",
"projectSlugOrId": "<PROJECT_SLUG>",
"regionUrl": "<REGION_URL>",
"limit": 5
}Then get details for the matching issue:
sentry:get_sentry_resource
{
"organizationSlug": "<ORG_SLUG>",
"resourceType": "issue",
"resourceId": "<ISSUE_ID>"
}Extract: stacktrace, breadcrumbs, tags (browser, OS, URL, release), event frequency.
If data is involved, verify expectations against reality using Supabase MCP or direct queries.
Before diving into debug, state:
"Pre-debug check:
- README/docs read: [list]
- Sentry context: [YES with details / NO — not production / not configured]
- Database state verified: [YES/NO — findings]
- Backend API checked: [YES/NO — status]
- Error scope identified: [FE only / BE only / Integration / Data]"1. Reproduce → 2. Isolate → 3. Research → 4. Identify → 5. Fix → 6. Verify → 7. PreventThis is the skill — everything after is mechanical. Before reading code to build a theory, construct one command that goes red on this bug and will go green when it's fixed (adapted from mattpocock/skills, MIT). In rough order of preference: a failing test at the nearest seam → a curl/HTTP script against the dev server → a CLI invocation with a fixture input → a headless browser script → replaying a captured trace/payload through the code path in isolation.
The loop is done when it is:
If you catch yourself forming a hypothesis before this command exists, stop — that is the exact failure this phase prevents. If you genuinely cannot build a loop, say so explicitly, list what you tried, and ask for a captured artifact (HAR, log dump, recording) instead of proceeding blind.
Error Report:
- What happened: [description]
- Expected behavior: [what should happen]
- Steps to reproduce:
1. [step]
2. [step]
- Environment: [browser/OS/Node version]
- Error message: [exact message]
- Stack trace: [if available]
- First seen: [when — correlate with deploys]git log for recent changes)Works in: Fails in:
├─ Production? ├─ Production?
├─ Staging? ├─ Staging?
├─ Local? ├─ Local?
├─ All browsers? ├─ Specific browser?
├─ All users? ├─ Specific user?
└─ All data? └─ Specific data?For data-related bugs, trace the full pipeline:
User Action → Frontend Handler → API Call → Backend Controller → Database → Response → State Update → RenderIdentify where the data goes wrong by checking each boundary.
Once the feedback loop is red, shrink the repro to the smallest scenario that still goes red: cut inputs, callers, config, and data one at a time, re-running the loop after each cut. Done when every remaining element is load-bearing — removing any one makes the loop go green. A minimal repro shrinks the hypothesis space and becomes the regression test in Phase 6.
For non-trivial errors, research the correct fix before implementing. Recognizing the framework or the error is not knowing its current behavior — search the exact error string and read the current docs even when you think you know the fix:
firecrawl:firecrawl_search
{
"query": "<framework> <exact error message> fix best practice",
"limit": 5,
"sources": [{ "type": "web" }]
}Then scrape the most relevant result:
firecrawl:firecrawl_scrape
{
"url": "<best-result-url>",
"formats": ["markdown"],
"onlyMainContent": true
}Also check official docs via Context7 if the error relates to a library:
context7:resolve-library-id
{
"libraryName": "<library>",
"query": "<error description>"
}Trust hierarchy: Official docs > maintainer posts > engineering blogs > Stack Overflow (current year, high votes).
Before writing any fix, state:
Do NOT apply these as the sole fix:
?. to suppress a TypeError → fix why the value is null?? [] fallback → handle loading/error states explicitlyif guards at the consumer → fix the producerthat exercises the real bug pattern; if no correct seam exists, document that as an architectural finding instead of writing a false-confidence test
# Run tests
npm test
# Or framework-specific
pytest
cargo test
go test ./...If the bug could recur in a different form, add monitoring:
If the bug was caused by a non-obvious interaction, add a comment explaining the constraint:
// Profile can be null for users who haven't completed onboarding.
// The API returns null (not 404) in this case. See: ISSUE-123.## Bug Investigation: [Title]
**Pre-Debug:**
- [ ] Docs/README read
- [ ] Sentry context fetched (if applicable)
- [ ] Database state checked (if data-related)
- [ ] Error scope identified
**Investigation:**
- [ ] Can reproduce locally (or have Sentry reproduction)
- [ ] Isolated to specific component/function/layer
- [ ] Research completed (Firecrawl/Context7)
- [ ] Root cause identified and stated
**Fix:**
- [ ] Fix addresses root cause (not symptoms)
- [ ] No anti-patterns used as sole fix
- [ ] Side effects checked (other callers)
- [ ] Tests pass
**Prevention:**
- [ ] Monitoring added (if applicable)
- [ ] Documentation updated (if non-obvious)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.