Skills systematic-debugging

📦

systematic-debugging

Name: systematic-debugging
Author: Cygnusfear

Content revision r1 Medium Risk ⚙️ External commands📁 Filesystem access🔑 Env variables

Debug Bugs with Root Cause Discipline

Random fixes waste time and create regressions. This skill guides Claude, Codex, and Claude Code through evidence-first debugging before code changes.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "systematic-debugging" from https://skillstore.io/skills/cygnusfear-systematic-debugging.md and its manifest at https://skillstore.io/api/skills/cygnusfear-systematic-debugging/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/cygnusfear-systematic-debugging.md Signed manifest GET /api/skills/cygnusfear-systematic-debugging/manifest Signed lockfile GET /api/skills/cygnusfear-systematic-debugging/lockfile

Test it

Using "systematic-debugging". A payment test sometimes receives pending instead of completed.

Expected outcome:

The response should identify the timing assumption, ask what event confirms completion, and propose waiting for that event instead of adding longer sleeps.

Using "systematic-debugging". A git command created files in the source directory during tests.

Expected outcome:

The response should trace the working directory value backward through callers and find where an empty or invalid path first entered the flow.

Using "systematic-debugging". A teammate suggests a quick retry to fix a production timeout.

Expected outcome:

The response should separate emergency mitigation from root cause analysis and require evidence before treating the retry as the final fix.

Security Audit

Medium Risk

v8 • 7/5/2026 Open versioned report

Most static findings are false positives from Markdown fences, TypeScript template literals, and benign NODE_ENV examples. Confirmed risks are limited to a local shell helper that runs tests and diagnostic examples that can reveal environment, keychain, path, or stack context. I found no evidence of data exfiltration, covert persistence, or explicit prompt-injection instructions to bypass marketplace review.

Files scanned

1,262

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Medium

find-polluter.sh:22-23 find-polluter.sh:42

Executable Helper Runs Local Tests

find-polluter.sh discovers matching test files and runs npm test for each one. This is useful debugging, but it executes repository code and should only run in trusted projects.

The script directly enumerates tests and invokes npm test. The intent is legitimate debugging, so the risk is constrained to local execution in untrusted repositories.

Medium

SKILL.md:90-105 defense-in-depth.md:75-82 root-cause-tracing.md:70-81

Sensitive Diagnostic Output Examples

The documentation includes examples that inspect environment state, keychain identities, current directories, and stack traces. Shared logs from these examples may reveal local context.

The cited examples explicitly print or log local diagnostic context. I found no network exfiltration, so this is a disclosure-risk warning rather than malicious behavior.

Low

test-pressure-2.md:3 test-pressure-3.md:3

Prompt-Like Pressure Test Instructions

The pressure-test files contain direct instructions to choose and act. They appear to be evaluation scenarios, but should remain separate from runtime skill instructions.

The text is imperative and addressed to an assistant, but it does not ask the model to ignore system instructions, skip review, or change security ratings.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

find-polluter.sh:22

Shell command substitution

TEST_FILES=$(find . -path "$TEST_PATTERN" | sort)

The shell helper executes find through command substitution using a caller-supplied pattern. Arguments are quoted, but it still performs local command execution in the repository.

Medium

find-polluter.sh:23

Shell command substitution

TOTAL=$(echo "$TEST_FILES" | wc -l | tr -d ' ')

This command substitution runs echo, wc, and tr over the discovered file list. The behavior is expected for the helper, but it is real shell command execution.

Medium

SKILL.md:90-106

Ruby/shell backtick execution

```bash

This starts a bash diagnostic block that runs echo, env, security, and codesign commands. The examples are legitimate but can inspect local environment and keychain state.

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/cygnusfear-systematic-debugging/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/cygnusfear-systematic-debugging/security.svg)](https://skillstore.io/skills/cygnusfear-systematic-debugging?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/cygnusfear-systematic-debugging?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cygnusfear-systematic-debugging/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/cygnusfear-systematic-debugging.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Cygnusfear. (2026). systematic-debugging security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cygnusfear-systematic-debugging/audits/8

BibTeX citation

@techreport{cygnusfear-cygnusfear-systematic-debugging-2026,
  author = {Cygnusfear},
  title = {systematic-debugging security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/cygnusfear-systematic-debugging/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "systematic-debugging security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "Cygnusfear"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/cygnusfear-systematic-debugging/audits/8"
identifiers:
  - type: other
    value: "skillstore:cygnusfear-systematic-debugging:audit:8"
    description: "Skillstore immutable audit report identifier"

Compare variants

12 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

Asmayaseen Recommended

asmayaseen-systematic-debugging

Skillstore Score 81

Evidence Confidence High

Skillstore usage 20

Updated

2026-08-21

ChrisWiles

chriswiles-systematic-debugging

Skillstore Score 79

Evidence Confidence High

Skillstore usage 11

Updated

2026-08-21

Doyajin174

doyajin174-systematic-debugging

Skillstore Score 79

Evidence Confidence High

Skillstore usage 9

Updated

2026-08-21

DMJGilbert

dmjgilbert-systematic-debugging

Skillstore Score 79

Evidence Confidence High

Skillstore usage 9

Updated

2026-08-21

CodingCossack

codingcossack-systematic-debugging

Skillstore Score 74

Evidence Confidence High

Skillstore usage 59

Updated

2026-08-21

ZhanlinCui

zhanlincui-systematic-debugging

Skillstore Score 71

Evidence Confidence High

Skillstore usage 90

Updated

2026-08-21

obra

obra-systematic-debugging

Skillstore Score 71

Evidence Confidence High

Skillstore usage 14

Updated

2026-08-21

Cycleaddict

cycleaddict-systematic-debugging

Skillstore Score 71

Evidence Confidence High

Skillstore usage 5

Updated

2026-08-21

davila7

davila7-systematic-debugging

Skillstore Score 70

Evidence Confidence High

Skillstore usage 5

Updated

2026-08-21

DYAI2025

dyai2025-systematic-debugging

Skillstore Score 70

Evidence Confidence Medium

Skillstore usage 45

Updated

2026-08-21

Cygnusfear Current

cygnusfear-systematic-debugging

Skillstore Score 50

Evidence Confidence High

Skillstore usage 5

Updated

2026-08-21

sickn33

sickn33-systematic-debugging

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 12

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Investigate Failing Tests

Use the process to reproduce failures, identify timing issues, and replace guesses with condition-based checks.

Stabilize Production Incidents

Use structured evidence gathering before deciding whether a fix, rollback, or mitigation addresses the real cause.

Review Debugging Plans

Use the phases to challenge symptom fixes and require a clear hypothesis before code changes.

Try These Prompts

Start a Bug Investigation

Use systematic-debugging for this bug. First list the exact error, reproduction steps, recent changes, and missing evidence before suggesting any fix.

Debug a Flaky Test

Apply systematic-debugging to this flaky test. Identify every arbitrary wait, the condition it tries to observe, and a safer condition-based replacement.

Trace a Deep Failure

Use root-cause tracing from systematic-debugging. Start at the symptom, trace each caller and data value backward, then state the first invalid input source.

Audit a Proposed Fix

Review this proposed fix with systematic-debugging. Decide whether root cause evidence exists, name the hypothesis, and list the smallest verification step.

Best Practices

Collect reproduction steps and error details before proposing changes.
Test one hypothesis at a time with the smallest useful change.
After fixing the source, add validation at layers that can receive bad data.

Avoid

Adding sleeps, retries, or guards without evidence of the root cause.
Bundling several changes and then guessing which change fixed the issue.
Treating senior opinion or past incidents as proof without checking the current system.