Borrowing it
Nothing to install: this file belongs to AlphaBitCore/nexus-gateway. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/AlphaBitCore/nexus-gateway/main/.claude/skills/wire-capability-probe/SKILL.mdgit clone --depth 1 https://github.com/AlphaBitCore/nexus-gatewayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alphabitcore/nexus-gateway/wire-capability-probe)<a href="https://agentmods.dev/skills/alphabitcore/nexus-gateway/wire-capability-probe"><img src="https://agentmods.dev/badge/skills/alphabitcore/nexus-gateway/wire-capability-probe.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03262 |
| Opus 5 | $0.00000 | $0.01631 |
| Sonnet 5 | $0.00000 | $0.00652 |
| Haiku 4.5 | $0.00000 | $0.00326 |
Grade B, and why
wire-capability-probe scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
Then `curl --data @<file>` at the vendor. This is what closes the loop: shape assertions passed Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Then `curl --data @<file>` at the vendor. This is what closes the loop: shape assertions passed How it starts
The opening of the file, as written. The whole thing — 290 lines — stays where its author put it; the contents beside it link to each section on GitHub.
wire-capability-probe
An upstream refusal is not an answer. It is one of three different answers wearing the same clothes:
| Verdict | What it means | What fixes it |
|---|---|---|
| The wire cannot | This API has no shape for what the caller sent | Refuse in our words, naming what and why; record the capability |
| We send the wrong form | The wire carries it, under a different name or in a different place | A codec mapping |
| The model cannot | The wire carries it; this model does not | Routing / catalog, not the codec |
Reading the refusal message tells you which one it is only when you are lucky. This skill is the procedure for when you are not, and its rules were each bought by a wrong verdict.
The core procedure: three probes, never one
For every refusal, run all three. The third is the one that changes verdicts.
1. THROUGH THE GATEWAY — reproduce it. This is the symptom.
2. DIRECT, OUR SHAPE — same bytes, straight to the vendor, no gateway.
Same refusal? → not a mistranslation.
Different? → the gateway is the problem. Stop here.
3. DIRECT, VENDOR SHAPE — the form the vendor's own docs describe.
200? → "we send the wrong form". Codec mapping.
Refused? → the wire genuinely cannot.
Worked example, and the reason this skill exists. Cohere answered
422 unrecognized content type 'file' for a document. Probe 2 reproduced it exactly, which
looked like confirmation. Probe 3 sent the same document in Cohere's documented top-level
documents array: 200, and the model answered from the document's contents. The verdict
flipped from "Cohere cannot take documents" — which was about to be written into the model
catalog — to "our codec has an unused mapping".
Three refusals probed the same day gave three different verdicts:
| Vendor | Our shape, direct | Vendor's documented shape | Verdict |
|---|---|---|---|
| Cohere | 422 unrecognized content type | top-level documents → 200, answered |
our gap |
| Moonshot | 400, identical to via-gateway | GET /v1/files → 200; upload-then-reference, no inline form |
no inline form — an upload capability, not a mapping |
| DeepSeek | 400 unknown variant | nothing documented | genuinely unsupported |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 290 lines · 0 tokens per session scan B 320e919f5dda
wire-capability-probe is a skill published in the GitHub repository AlphaBitCore/nexus-gateway (23 stars, last pushed 5d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 3,262 tokens. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
omni-inference
The core OpenAI-compatible inference endpoints: chat completions, embeddings, images, audio (TTS/STT), moderations, rerank, and the Responses API. The primary integration surface for AI agents.
omni-providers
Manage provider connections, API keys, OAuth flows, and connection tests via the REST API. List, add, update, remove, and test AI provider integrations across OmniRoute's 327-provider catalog.
omni-combos-routing
Create and manage routing combos with 19 strategies (priority, weighted, round-robin, Auto-combo, and more). Configure fallback chains, test routing outcomes, and retrieve combo metrics.
omni-auth
Manage API key authentication and session tokens. Start here to authenticate requests via Bearer token, obtain session cookies, and configure login requirements for the OmniRoute API.
omni-api-keys
Create, list, rotate, and revoke OmniRoute API keys. Control per-key scopes, spending limits, and expiration. Keys gate access to all proxy and management endpoints.
omni-mcp
Connect to the OmniRoute MCP server (110 tools, 3 transports: SSE/stdio/HTTP). Covers routing, cache, compression, memory, skills, providers, and audit tools across 33 permission scopes.