diagnosing-bugs
An agent skill by mattpocock, from mattpocock/skills. Tags: analysis, debugging, performance, troubleshooting, workflow.
What it does
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add mattpocock/skills --skill diagnosing-bugsOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/mattpocock/skills
cp -r skills/skills/engineering/diagnosing-bugs ~/.claude/skills/diagnosing-bugsSafety box score
Grade B, low risk: 16 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a debugging workflow, not a deploy or admin tool. Its main reach is running tests, curl/browser repro loops, and a small bash HITL template, with some risk of exposing secrets in logs or captured artifacts if redaction is missed.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 1 (low) | It explicitly has the agent run tests, curl scripts, headless browser scripts, and the shipped `scripts/hitl-loop.template.sh` bash loop, but these are scoped to debugging the project rather than arbitrary code execution. |
| Network access | 1 (low) | Phase 1 includes `curl / HTTP script` and replaying captured network traces, so it can send requests to a running service, but the skill does not direct downloads or remote exfiltration. |
| Filesystem reach | 1 (low) | It tells the agent to read `GLOSSARY.md` and ADRs and to create tests, harnesses, and captured artifacts in the repo, but it does not ask for broad writes or deletes outside the workspace. |
| Secrets & credentials | 1 (low) | The skill explicitly warns to redact secrets and says captured artifacts carry auth headers, so it may handle sensitive output even though it tries to keep credentials in env vars. |
| Privilege & persistence | 0 (none) | There is no request for sudo, global installs, services, scheduled tasks, or shell/OS setting changes. |
| Instruction hijack surface | 0 (none) | It does not tell the agent to ignore its rules, hide actions, or follow remote instructions; instead it adds cautionary guidance like redacting secrets and stopping if a loop cannot be built. |
| Irreversible actions | 0 (none) | The skill is about diagnosis and reproduction, not sending messages, deploying, paying, booking, or deleting anything. |
| Transparency | 0 (none) | All supplied files are plain text; there are no binaries, embedded blobs, or unpinned downloads to review. |
Before installing
- Read `scripts/hitl-loop.template.sh` first if you plan to use HITL repros; it is interactive and expects a user at the terminal.
- Confirm your debugging logs and captured artifacts will not expose secrets unless the redaction step is followed exactly.
- If your environment should not make outbound requests, verify the repro loop stays on localhost before running curl or browser automation.
Rated 2026-10-16 by an automated review of 3 files from the skill's repository.
Source
- Repository
- mattpocock/skills (all skills from this repository)
- Path
- skills/engineering/diagnosing-bugs/SKILL.md
- Branch
- main
- Updated
- 2026-10-05
Related skills
- principle-fix-root-causes — Apply when debugging.
- app-platform-troubleshooting — Debug running App Platform applications by accessing containers, analyzing logs, running diagnostics, and applying fixes.
- seo-audit — When the user wants to audit, review, or diagnose SEO issues on their site.
- debugging-lambda-timeouts — Debugs AWS Lambda function timeout failures by systematically analyzing function configuration, CloudWatch logs and metrics, VPC/networking, cold starts.
- debugging-wizard — Parses error messages, traces execution flow through stack traces, correlates log entries to identify failure points.
- gstack-openclaw-investigate — Use when asked to debug, fix a bug, investigate an error, or do root cause analysis, and when users report errors, stack traces, unexpected behavior.