[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CZNNC55PH96VGBJASWSCEN":3,"skill-same:01M6CZNNC55PH96VGBJASWSCEN":48},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":14,"categories":15,"keywords":16,"publishedAt":17,"linkOnly":18,"markdownContent":19,"markdownBody":19,"frontMatter":20,"refName":21,"commitSha":22,"skillDirectory":23,"forksCount":24,"repositoryHtmlUrl":25,"repositoryHomepageUrl":6,"ownerHtmlUrl":26,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":27,"install":28,"resources":41},"01M6CZNNC55PH96VGBJASWSCEN","diagnose",null,"Testing-itay\u002FDevTools-Security-Lab","Testing-itay","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F230151326?v=4","01M6CZH4Q5Z571N5ZRZWMQ3YBS","01M6CZH4W55EHV4P1D3SNNRXSS",0,"MIT","https:\u002F\u002Fgithub.com\u002FTesting-itay\u002FDevTools-Security-Lab\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fdiagnose\u002FSKILL.md",[],[5],"2026-11-10 10:12:30",false,"\n\n\n\n---\nname: diagnose\ndescription: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" \u002F \"debug this\", reports a bug, says something is broken\u002Fthrowing\u002Ffailing, or describes a performance regression.\n---\n\n# Diagnose\n\nA discipline for hard bugs. Skip phases only when explicitly justified.\n\nWhen exploring the codebase, use the project's domain glossary to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.\n\n## Phase 1 — Build a feedback loop\n\n**This is the skill.** Everything else is mechanical. If you have a fast, deterministic, agent-runnable pass\u002Ffail signal for the bug, you will find the cause — bisection, hypothesis-testing, and instrumentation all just consume that signal. If you don't have one, no amount of staring at code will save you.\n\nSpend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**\n\n### Ways to construct one — try them in roughly this order\n\n1. **Failing test** at whatever seam reaches the bug — unit, integration, e2e.\n2. **Curl \u002F HTTP script** against a running dev server.\n3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.\n4. **Headless browser script** (Playwright \u002F Puppeteer) — drives the UI, asserts on DOM\u002Fconsole\u002Fnetwork.\n5. **Replay a captured trace.** Save a real network request \u002F payload \u002F event log to disk; replay it through the code path in isolation.\n6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.\n7. **Property \u002F fuzz loop.** If the bug is \"sometimes wrong output\", run 1000 random inputs and look for the failure mode.\n8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate \"boot at state X, check, repeat\" so you can `git bisect run` it.\n9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.\n10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts\u002Fhitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.\n\nBuild the right feedback loop, and the bug is 90% fixed.\n\n### Iterate on the loop itself\n\nTreat the loop as a product. Once you have _a_ loop, ask:\n\n- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)\n- Can I make the signal sharper? (Assert on the specific symptom, not \"didn't crash\".)\n- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)\n\nA 30-second flaky loop is barely better than no loop. A 2-second deterministic loop is a debugging superpower.\n\n### Non-deterministic bugs\n\nThe goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.\n\n### When you genuinely cannot build a loop\n\nStop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.\n\nDo not proceed to Phase 2 until you have a loop you believe in.\n\n## Phase 2 — Reproduce\n\nRun the loop. Watch the bug appear.\n\nConfirm:\n\n- [ ] The loop produces the failure mode the **user** described — not a different failure that happens to be nearby. Wrong bug = wrong fix.\n- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).\n- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.\n\nDo not proceed until you reproduce the bug.\n\n## Phase 3 — Hypothesise\n\nGenerate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.\n\nEach hypothesis must be **falsifiable**: state the prediction it makes.\n\n> Format: \"If \u003CX> is the cause, then \u003Cchanging Y> will make the bug disappear \u002F \u003Cchanging Z> will make it worse.\"\n\nIf you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.\n\n**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly (\"we just deployed a change to #3\"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.\n\n## Phase 4 — Instrument\n\nEach probe must map to a specific prediction from Phase 3. **Change one variable at a time.**\n\nTool preference:\n\n1. **Debugger \u002F REPL inspection** if the env supports it. One breakpoint beats ten logs.\n2. **Targeted logs** at the boundaries that distinguish hypotheses.\n3. Never \"log everything and grep\".\n\n**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.\n\n**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.\n\n## Phase 5 — Fix + regression test\n\nWrite the regression test **before the fix** — but only if there is a **correct seam** for it.\n\nA correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.\n\n**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.\n\nIf a correct seam exists:\n\n1. Turn the minimised repro into a failing test at that seam.\n2. Watch it fail.\n3. Apply the fix.\n4. Watch it pass.\n5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.\n\n## Phase 6 — Cleanup + post-mortem\n\nRequired before declaring done:\n\n- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)\n- [ ] Regression test passes (or absence of seam is documented)\n- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)\n- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)\n- [ ] The hypothesis that turned out correct is stated in the commit \u002F PR message — so the next debugger learns\n\n**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `\u002Fimprove-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before — you have more information now than when you started.\n",{},"main","1188d0dcbd4e64256d35bfe14c955ba1c541b1de",".github\u002Fskills\u002Fdiagnose",13,"https:\u002F\u002Fgithub.com\u002FTesting-itay\u002FDevTools-Security-Lab","https:\u002F\u002Fgithub.com\u002FTesting-itay","2026-10-16 16:13:27",{"source":7,"skillName":5,"commands":29,"prompt":39,"zipAvailable":40},[30,33,36],{"tool":31,"command":32},"npx","npx skills add Testing-itay\u002FDevTools-Security-Lab --skill diagnose",{"tool":34,"command":35},"bunx","bunx skills add Testing-itay\u002FDevTools-Security-Lab --skill diagnose",{"tool":37,"command":38},"pnpm","pnpm dlx skills add Testing-itay\u002FDevTools-Security-Lab --skill diagnose","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FTesting-itay\u002FDevTools-Security-Lab\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fdiagnose\u002FSKILL.md",true,[42],{"path":43,"resourceType":44,"resourceTypeDesc":45,"sizeBytes":46,"sourceHtmlUrl":47},"scripts\u002Fhitl-loop.template.sh","SCRIPT","脚本",1164,"https:\u002F\u002Fgithub.com\u002FTesting-itay\u002FDevTools-Security-Lab\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fdiagnose\u002Fscripts\u002Fhitl-loop.template.sh",[49,58,67,76,85,90],{"skillNo":50,"name":51,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":52,"categories":53,"keywords":54,"publishedAt":17},"01M6CZR9VVRMS754ZKH7NPNMB1","sds-plugin-a11y-check","https:\u002F\u002Fgithub.com\u002FTesting-itay\u002FDevTools-Security-Lab\u002Fblob\u002Fmain\u002Fsrc\u002FnewDIR\u002Fbundles\u002Fplugins\u002Fsds-frontend-plugin\u002Fskills\u002Fsds-plugin-a11y-check\u002FSKILL.md",[],[55,56,57],"sds plugin a11y check","check","plugin",{"skillNo":59,"name":60,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":17},"01M6CZR8FQ30QGEV5D3SB6DDKP","endpoint-review","https:\u002F\u002Fgithub.com\u002FTesting-itay\u002FDevTools-Security-Lab\u002Fblob\u002Fmain\u002Fsrc\u002FnewDIR\u002Fbundles\u002Fplugins\u002Fpython-api-plugin\u002Fskills\u002Fendpoint-review\u002FSKILL.md",[],[64,65,66],"endpoint review","endpoint","review",{"skillNo":68,"name":69,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":17},"01M6CZR6TYBN5EMBM70E096E66","schema-draft","https:\u002F\u002Fgithub.com\u002FTesting-itay\u002FDevTools-Security-Lab\u002Fblob\u002Fmain\u002Fsrc\u002FnewDIR\u002Fbundles\u002Fplugins\u002Fpython-api-plugin\u002Fagents\u002Fpy-plugin-endpoint-designer\u002Fskills\u002Fschema-draft\u002FSKILL.md",[],[73,74,75],"schema","schema draft","draft",{"skillNo":77,"name":78,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":17},"01M6CZR5SDWF91FHDK54XHXS67","doc-outline","https:\u002F\u002Fgithub.com\u002FTesting-itay\u002FDevTools-Security-Lab\u002Fblob\u002Fmain\u002Fsrc\u002FnewDIR\u002Fbundles\u002Fplugins\u002Fai-documentation-workflow\u002Fskills\u002Fdoc-outline\u002FSKILL.md",[],[82,83,84],"doc outline","outline","doc",{"skillNo":86,"name":51,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":17},"01M6CZR3Z4WZCBA5FVJZB65B1Y","https:\u002F\u002Fgithub.com\u002FTesting-itay\u002FDevTools-Security-Lab\u002Fblob\u002Fmain\u002Fsrc\u002FnewD\u002FnewDIR\u002Fbundles\u002Fplugins\u002Fsds-frontend-plugin\u002Fskills\u002Fsds-plugin-a11y-check\u002FSKILL.md",[],[55,56,57],{"skillNo":91,"name":60,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":6,"repositoryNo":11,"starsCount":12,"licenseSpdxId":13,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":17},"01M6CZR2PR7T4XYSJJWQYYPXVW","https:\u002F\u002Fgithub.com\u002FTesting-itay\u002FDevTools-Security-Lab\u002Fblob\u002Fmain\u002Fsrc\u002FnewD\u002FnewDIR\u002Fbundles\u002Fplugins\u002Fpython-api-plugin\u002Fskills\u002Fendpoint-review\u002FSKILL.md",[],[66,64,65]]