error-pattern-safety

Q: How do I install error-pattern-safety?

Run npx skills add https://github.com/github/gh-aw --skill error-pattern-safety in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/error-pattern-safety/ (personal) or .claude/skills/error-pattern-safety/ (project).

by github OfficialAI & Agents

Apply safe error-pattern matching rules for agentic engines.

Installs: 61
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/github/gh-aw --skill error-pattern-safety

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads error-pattern-safety automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Error Pattern Safety Guidelines

Use these regex safety rules in agentic engines to prevent JavaScript infinite loops.

The Problem

With the JavaScript global flag (/pattern/g), zero-width matches can cause infinite loops because:

JavaScript's regex.exec() with the g flag uses lastIndex to track position
When a pattern matches zero-width, lastIndex doesn't advance
The same position is matched repeatedly, causing an infinite loop

Dangerous Pattern Examples

❌ NEVER USE THESE PATTERNS:

// Pure .* - matches everything including empty string at end
/.*/g

// Single character with * - matches zero or more (including zero)
/a*/g

// Patterns that can match empty string
/(x|y)*/g

Safe Pattern Examples

✅ ALWAYS USE PATTERNS LIKE THESE:

// Required prefix before .*
/error.*/gi
/error.*permission.*denied/gi

// Specific structure with required content
/\[(\d{4}-\d{2}-\d{2})\]\s+(ERROR):\s+(.+)/g

// Required characters throughout
/access denied.*user.*not authorized/gi

Pattern Safety Rules

Always require at least one character match
- Use .+ instead of .* when you need "something"
- Ensure pattern has required prefix/suffix
Never use bare .* as the entire pattern
- Always combine with required text: error.*
- Never just .* or .*?

Test patterns against empty string

const regex = /your-pattern/g;
if (regex.test("")) {
  throw new Error("Pattern matches empty string - DANGEROUS!");
}

Use specific anchors when possible
- Start: ^error.*
- End: .*error$
- Word boundaries: \berror\b

Validation Tests

All error patterns must pass these tests:

Go Tests (pkg/workflow/engine_error_patterns_infinite_loop_test.go)

// Test that pattern doesn't match empty string
func TestPatternSafety(t *testing.T) {
    pattern := "your-pattern"
    regex := regexp.MustCompile(pattern)
    
    if regex.MatchString("") {
        t.Error("Pattern matches empty string!")
    }
}

JavaScript Tests (pkg/workflow/js/validate_errors.test.cjs)

test("should not match empty string", () => {
  const regex = new RegExp("your-pattern", "g");
  expect(regex.test("")).toBe(false);
});

Safety Mechanisms in validate_errors.cjs

The validate_errors.cjs script has built-in protections:

Zero-width detection: Checks if regex.lastIndex stops advancing
Iteration warning: Warns at 1000 iterations
Hard limit: Stops at 10,000 iterations to prevent hang

// Safety check in validate_errors.cjs
if (regex.lastIndex === lastIndex) {
  core.error(`Infinite loop detected! Pattern: ${pattern.pattern}`);
  break;
}

Adding New Error Patterns

When adding new error patterns to engines:

Write the pattern with required content

{
    Pattern:      `(?i)error.*permission.*denied`,
    LevelGroup:   0,
    MessageGroup: 0,
    Description:  "Permission denied error",
}

Test against empty string
- Run: make test-unit
- Checks: TestAllEnginePatternsSafe
Test with actual log samples
- Ensure it matches real errors
- Ensure it doesn't match informational text
Document the pattern
- Add clear description
- Note what it's designed to catch

Pattern Conversion: Go to JavaScript

Patterns are converted from Go to JavaScript:

// Go pattern (case-insensitive flag)
Pattern: `(?i)error.*permission.*denied`

// Converted to JavaScript
new RegExp("error.*permission.*denied", "gi")

The (?i) prefix is removed because JavaScript uses the i flag instead.

Examples from Current Codebase

✅ Safe Patterns

// Requires "error" prefix
Pattern: `(?i)error.*permission.*denied`

// Requires specific timestamp format
Pattern: `(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z)\s+\[(ERROR)\]\s+(.+)`

// Requires "access denied" prefix
Pattern: `(?i)access denied.*user.*not authorized`

How to Fix Unsafe Patterns

If you find a pattern that matches empty string:

Before (unsafe):

Pattern: `.*error.*`  // Can match empty at start/end

After (safe):

Pattern: `error.*`     // Requires "error" at start
// OR
Pattern: `.*error.+`   // Requires "error" and at least one char after
// OR
Pattern: `\berror\b.*` // Requires word "error"

Testing Checklist

Before committing pattern changes:

Run make test-unit
Check TestAllEnginePatternsSafe passes
Check TestErrorPatternsNoInfiniteLoopPotential passes
Run JavaScript tests: cd pkg/workflow/js && npm test
Verify pattern matches intended error messages
Verify pattern doesn't match informational text

References

Go regex syntax: https://pkg.go.dev/regexp/syntax
JavaScript regex: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions
Test files:
- pkg/workflow/engine_error_patterns_infinite_loop_test.go
- pkg/workflow/js/validate_errors.test.cjs
- pkg/workflow/error_pattern_tuning_test.go

FAQ

What does the error-pattern-safety skill do?

Apply safe error-pattern matching rules for agentic engines.

How do I install error-pattern-safety?

Run npx skills add https://github.com/github/gh-aw --skill error-pattern-safety in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/error-pattern-safety/ (personal) or .claude/skills/error-pattern-safety/ (project).

Which AI agents can use error-pattern-safety?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is error-pattern-safety safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains error-pattern-safety?

It is published by github in github/gh-aw, and it is an official skill from the maker of the technology it covers. It has 61 recorded installs.

Popular ai & agents skills

View category →

google-agents-cli-publish

google/agents-cli

This skill should be used when the user wants to "publish an agent", "publish my ADK agent", "register an agent with Gemini", "publish to Gemini" (formerly Gemini Enterprise), or needs guidance on the agents-cli publish gemini command. Also use when the user wants to "manage agents in Agent Registry", "list/update/delete registered agents", or "register an MCP server". Covers ADK vs A2A registration modes, programmatic and interactive usage, flag reference, auto-detection from deployment metadata, Agent Registry fleet management, and troubleshooting. Part of the agents-cli skills suite. Do NOT use for deployment (use google-agents-cli-deploy).

AI & Agents513.9K installs

google-agents-cli-eval

google/agents-cli

This skill should be used when the user wants to "run an evaluation", "evaluate my agent", "evaluate my ADK agent", "write an eval dataset", "analyze eval failures", "compare eval results", "optimize agent", or needs guidance on the Gemini platform eval methodology and the Quality Flywheel. Covers eval metrics, dataset schema, LLM-as-judge scoring, and common failure causes. Applies to any agents-cli project, whatever framework the agent is written in. Do NOT use for agent API code patterns (ADK: use google-agents-cli-adk-code), deployment (use google-agents-cli-deploy), or project scaffolding (use google-agents-cli-scaffold).

AI & Agents513.5K installs

skill-creator

anthropics/skills

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

OfficialAI & Agents416.4K installs

codex-pet

prime-skills/runcomfy-agent-skills

Codex Pet generator on RunComfy. Build a Codex-compatible Codex Pet spritesheet.webp + pet.json from a single reference image, drop it into ${CODEXHOME:-$HOME/.codex}/pets/ / and Codex picks it up as a custom Codex Pet next to the 8 built-ins. This skill produces the exact Codex Pet atlas Codex expects (1536x1872 PNG/WebP, 8 cols x 9 rows, 192x208 cells, 9 animation states — idle, running-right, running-left, waving, jumping, failed, waiting, running, review). Calls OpenAI GPT Image 2 edit ONCE via the local RunComfy CLI as runcomfy run openai/gpt-image-2/edit to produce a canonical Codex Pet pose, then assembles all 9 animation rows programmatically with ImageMagick micro-transforms — no Codex Pro, no $imagegen, no OPENAIAPIKEY required, only RUNCOMFYTOKEN. Triggers on "codex pet", "create codex pet", "make codex pet", "hatch codex pet", "/hatch image", "desktop pet codex", "codex pets", "spritesheet.webp", or any explicit ask to build a custom pet for OpenAI Codex.

AI & Agents402.1K installs

full-output-enforcement

leonxlnx/taste-skill

Overrides default LLM truncation behavior. Enforces complete code generation, bans placeholder patterns, and handles token-limit splits cleanly. Apply to any task requiring exhaustive, unabridged output.

AI & Agents401K installs

executing-plans

obra/superpowers

Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution, or no subagent tool is available

AI & Agents245.7K installs

error-pattern-safety

Install

Install

Describe the task

Review the result

SKILL.md

Error Pattern Safety Guidelines

The Problem

Dangerous Pattern Examples

Safe Pattern Examples

Pattern Safety Rules

Validation Tests

Go Tests (pkg/workflow/engine_error_patterns_infinite_loop_test.go)

JavaScript Tests (pkg/workflow/js/validate_errors.test.cjs)

Safety Mechanisms in validate_errors.cjs

Adding New Error Patterns

Pattern Conversion: Go to JavaScript

Examples from Current Codebase

✅ Safe Patterns

How to Fix Unsafe Patterns

Testing Checklist

References

FAQ

More from github/gh-aw

github-mcp-server

developer

javascript-refactoring

debugging-workflows

agentic-workflows

github-pr-query

Popular ai & agents skills

google-agents-cli-publish

google-agents-cli-eval

skill-creator

codex-pet

full-output-enforcement

executing-plans