systematic-debugging — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited systematic-debugging (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Random fixes waste time and create new bugs. Quick patches mask underlying issues.
Core principle: ALWAYS find root cause before attempting fixes. Symptom fixes are failure.
NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRSTIf you haven't completed Phase 1, you cannot propose fixes.
BEFORE attempting ANY fix:
When system has multiple components (CI -> build -> signing, API -> service -> database):
For EACH component boundary:
- Log what data enters component
- Log what data exits component
- Verify environment/config propagation
Run once to gather evidence showing WHERE it breaks
THEN analyze to identify failing componentSee references/root-cause-tracing.md for backward tracing technique.
Quick version: Where does bad value originate? Keep tracing up until you find the source. Fix at source, not symptom.
Pattern indicating architectural problem:
STOP. Discuss with user before attempting more fixes.
If you catch yourself thinking:
ALL of these mean: STOP. Return to Phase 1.
When you fix a bug, validate at EVERY layer:
| Layer | Purpose | Example |
|---|---|---|
| Entry Point | Reject invalid input at API boundary | if (!dir) throw new Error('dir required') |
| Business Logic | Ensure data makes sense for operation | Validate before processing |
| Environment Guards | Prevent dangerous ops in specific contexts | Refuse git init outside tmpdir in tests |
| Debug Instrumentation | Capture context for forensics | Log with stack trace before dangerous ops |
Single validation feels sufficient, but different code paths bypass it. Make bugs structurally impossible.
Flaky tests guess at timing. Wait for actual conditions instead:
# BAD: Guessing at timing
await asyncio.sleep(0.05)
result = get_result()
# GOOD: Wait for condition
await wait_for(lambda: get_result() is not None)
result = get_result()Pattern:
async def wait_for(condition, timeout_ms=5000):
start = time.time()
while True:
if condition():
return
if (time.time() - start) * 1000 > timeout_ms:
raise TimeoutError("Condition not met")
await asyncio.sleep(0.01) # Poll every 10ms| Excuse | Reality |
|---|---|
| "Issue is simple, don't need process" | Simple issues have root causes too. Process is fast for simple bugs. |
| "Emergency, no time for process" | Systematic debugging is FASTER than guess-and-check thrashing. |
| "Just try this first, then investigate" | First fix sets the pattern. Do it right from the start. |
| "I see the problem, let me fix it" | Seeing symptoms != understanding root cause. |
| "One more fix attempt" (after 2+ failures) | 3+ failures = architectural problem. Question pattern, don't fix again. |
Run: python scripts/verify.py
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.