debugging — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited debugging (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Core Principle: ALWAYS find root cause before attempting fixes. Symptom fixes are failure.
NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRSTUse when:
Do NOT use when:
testing-frameworktest-driven-developmentcode-reviewcicd-pipelinesWhat type of issue are you debugging?
├── Test failure
│ ├── Always fails (deterministic) -> Phase 1-4 systematic debugging
│ ├── Intermittently fails (flaky) -> find-polluter.sh + timing analysis
│ └── Only fails in CI, not locally -> Environment audit (OS, runtime, services)
├── Browser/UI bug
│ ├── Visual/layout issue -> Chrome DevTools scripts + screenshot
│ ├── Console errors -> console.js monitoring
│ ├── Network/API issue -> network.js tracking
│ └── Performance issue -> performance.js + Core Web Vitals
├── CI/CD pipeline failure
│ ├── Build error (module not found, etc.) -> Root cause tracing + cache check
│ ├── Timeout -> Pipeline analyzer + caching optimization
│ ├── Permission error -> Permissions block audit
│ └── Docker connection issue -> Runner/DinD configuration
├── Performance regression
│ ├── Known when it started -> Git diff between good and current deploy
│ └── Unknown source -> Performance profiler + trace recording
├── 3+ fix attempts have failed
│ └── STOP. Question the architecture. Return to Phase 1.
└── Not a debugging problem? -> See related skills| Issue Type | Primary Tool | Reference |
|---|---|---|
| Test failures | Systematic Debugging | references/systematic-debugging/ |
| Browser/UI bugs | Chrome DevTools + E2E Testing | references/cdp-domains.md, references/e2e-workflow/ |
| CI/CD failures | Pipeline Analyzer | scripts/cicd/, references/cicd-troubleshooting.md |
| Performance issues | Performance Profiler | references/performance-guide.md |
| Build errors | Root Cause Tracing | references/root-cause-tracing.md |
| Flaky tests | Find Polluter Script | scripts/find-polluter.sh |
You MUST complete each phase before proceeding to the next.
BEFORE attempting ANY fix:
See references/root-cause-tracing.md for detailed backward tracing technique.
Installation:
cd scripts/chrome-devtools && npm installAvailable Scripts:
| Script | Purpose |
|---|---|
navigate.js | Navigate to URLs |
screenshot.js | Capture screenshots (auto-compresses >5MB) |
click.js | Click elements |
fill.js | Fill form fields |
evaluate.js | Execute JavaScript in page context |
snapshot.js | Extract interactive elements with metadata |
console.js | Monitor console messages/errors |
network.js | Track HTTP requests/responses |
performance.js | Measure Core Web Vitals + record traces |
Usage:
cd scripts/chrome-devtools
node screenshot.js --url https://example.com --output ./page.png
node console.js --url https://example.com --types error,warn --duration 50008-phase visual debugging with Playwright:
references/e2e-workflow/phase-1-discovery.md)Templates: templates/e2e-testing/ | Examples: examples/e2e-testing/
python3 scripts/cicd/ci_health.py --platform github --repo owner/repo
python3 scripts/cicd/pipeline_analyzer.py --platform github --workflow .github/workflows/ci.yml| Error Pattern | Common Cause | Quick Fix |
|---|---|---|
| "Module not found" | Missing dependency or cache issue | Clear cache, run npm ci |
| "Timeout" | Job taking too long | Add caching, increase timeout |
| "Permission denied" | Missing permissions | Add to permissions: block |
| "Cannot connect to Docker" | Docker not available | Use correct runner or DinD |
| Intermittent failures | Flaky tests or race conditions | Add retries, fix timing issues |
Debug logging: GitHub Actions: ACTIONS_RUNNER_DEBUG=true | GitLab CI: CI_DEBUG_TRACE: "true"
./scripts/find-polluter.sh '.git' 'src/**/*.test.ts'Runs tests one-by-one, stops at first polluter.
After fixing a bug, add validation at EVERY layer:
See references/defense-in-depth.md for complete pattern.
NO COMPLETION CLAIMS WITHOUT FRESH VERIFICATION EVIDENCE| Anti-Pattern | Problem | Solution | |
|---|---|---|---|
| "Quick fix for now, investigate later" | Creates more bugs than it resolves; root cause remains | Iron Law: no fixes without Phase 1. Always complete root cause investigation first | |
| Guessing at fixes without understanding | 40% first-time fix rate vs 95% systematic; 2-3 hours vs 15-30 min | Follow all 4 phases; form single hypothesis and test minimally | |
| "Just try changing X and see if it works" | Random changes compound problems; introduce new bugs | Test ONE hypothesis at a time with smallest possible change | |
| Adding multiple changes at once | Cannot identify which change fixed (or broke) what | One change at a time; verify after each | |
| Skipping the test / manual verification only | No regression protection; bug will recur | Always create failing test case first (Phase 4, Step 1) | |
| 3+ failed fix attempts without stopping | Indicates wrong root cause hypothesis | STOP after 3 failures; question the architecture; return to Phase 1 | |
| Trusting "API returns 200" as success | 200 status doesn't mean response shape is correct for consumer | Check actual response data, not just status; validate contracts | |
| Proposing fixes before investigation | "I think the fix is X" skips root cause analysis | Let Phase 1 complete before suggesting any fix | |
| Omitting the stack trace | Most information-dense debugging input discarded | Always paste exact error message, stack trace, file paths, line numbers | |
| Fixing at symptom, not source | Bad value originates elsewhere; symptom fix masks real problem | Trace data flow upstream to source; fix at origin (Phase 1, Step 5) | |
| Assuming "it works" after one test passes | Fix may not cover edge cases; other components may break | Run full test suite after fix; verify at each defense layer | |
| Debugging without a failing test | No reproducibility; can't verify fix works or stays fixed | Create failing test first (Phase 4, Step 1); it's proof the fix is correct | |
| Ignoring environment differences | Bug appears only in CI/production but not locally | Audit OS, runtime version, env vars, services, network before assuming code is the cause |
If you catch yourself thinking:
ALL of these mean: STOP. Return to Phase 1.
references/systematic-debugging/ — Core debugging methodologyreferences/root-cause-tracing.md — Backward tracing techniquereferences/defense-in-depth.md — Multi-layer validationreferences/verification-before-completion.md — Verification checklistreferences/cdp-domains.md — Chrome DevTools Protocol (47 domains)references/puppeteer-reference.md — Puppeteer API patternsreferences/performance-guide.md — Performance debuggingreferences/cicd-*.md — CI/CD specific referencesreferences/e2e-workflow/ — E2E testing workflow phasesreferences/workflow-modules/ — AI-powered debugging modulesscripts/chrome-devtools/ — Browser automation scriptsscripts/cicd/ — CI/CD analysis toolsscripts/find-polluter.sh — Test pollution findertemplates/e2e-testing/ — Playwright test templatestemplates/cicd/ — GitHub Actions + GitLab CI templates~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.