surgical-patch
An agent skill by JuliusBrussee, from JuliusBrussee/caveman. Tags: bug-fix, code, debugging, testing.
What it does
Fix bugs and small behavior changes at the narrowest responsible layer. Use when regression proof, preserved surrounding behavior, and task-relevant tests matter.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add JuliusBrussee/caveman --skill surgical-patchOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/JuliusBrussee/caveman
cp -r caveman/skills/surgical-patch ~/.claude/skills/surgical-patchSafety box score
Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is documentation-only: it tells an agent to make narrow code changes and run focused tests, but it ships no scripts or installers. The main thing it touches is the agent’s patching workflow; there is no inherent network, filesystem, secret, or privilege blast radius in the skill files themselves.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No shell commands, scripts, or code evaluation are present; only prose in `SKILL.md` and a small YAML config. |
| Network access | 0 (none) | The files do not download from or send data to any remote host. |
| Filesystem reach | 0 (none) | There are no instructions or scripts that read, write, or delete files outside the project. |
| Secrets & credentials | 0 (none) | Nothing in the skill asks for tokens, keys, passwords, or credential stores. |
| Privilege & persistence | 0 (none) | No sudo, global installs, services, or shell/OS settings are mentioned. |
| Instruction hijack surface | 0 (none) | The text does not ask the agent to ignore rules, hide actions, or follow remote instructions. |
| Irreversible actions | 0 (none) | It only says to fix bugs and run focused proof; it does not deploy, publish, send messages, or otherwise act externally. |
| Transparency | 0 (none) | All shipped files are small, plain text, and fully readable; no binaries or opaque installers are included. |
Before installing
- Inspect `SKILL.md` and `agents/openai.yaml` to confirm they are the only shipped files and contain no executable steps.
- If this skill will be paired with broader agent tooling, verify that the surrounding runner—not the skill—does not grant extra privileges or credentials by default.
Rated 2026-10-16 by an automated review of 2 files from the skill's repository.
Source
- Repository
- JuliusBrussee/caveman (all skills from this repository)
- Path
- skills/surgical-patch/SKILL.md
- Branch
- main
- Updated
- 2026-10-05
Related skills
- qa — Fix browser/API/CLI/job/worker/webhook bugs. (gstack)
- address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
- blast-radius — Find what a change could break somewhere else before it ships, beyond the diff.
- check-compiler-errors — Run compile and type-check commands and report failures
- control-cli — Build or adapt a local harness to drive, inspect, and profile an interactive CLI or TUI without external services.
- control-ui — Build or adapt a local browser/CDP harness to drive and inspect a web, IDE, or Electron UI.