Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ArisGuimera/MobiAI-Core --skill mobiai-create-prgit clone --depth 1 https://github.com/ArisGuimera/MobiAI-CoreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arisguimera/mobiai-core/mobiai-create-pr)<a href="https://agentmods.dev/skills/arisguimera/mobiai-core/mobiai-create-pr"><img src="https://agentmods.dev/badge/skills/arisguimera/mobiai-core/mobiai-create-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/arisguimera/mobiai-core/mobiai-create-pr"><img src="https://agentmods.dev/badge/skills/arisguimera/mobiai-core/mobiai-create-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 49 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Excessive Agency · line 32 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.02220 |
| Opus 5.5 | $0.00030 | $0.00888 |
| Sonnet 5.5 | $0.00015 | $0.00444 |
| Haiku 4.5 | $0.00007 | $0.00222 |
Grade A, and why
mobiai-create-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 200 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Create PR
Create a well-structured pull request for mobile code changes.
When to Use
Match on intent, not specific words or languages. The user's phrasing is a signal, not a keyword match — read meaning in context.
Explicit intent (user directly expresses they want to save, share, or submit changes):
- Intent to commit the current work
- Intent to push the current branch
- Intent to open a pull request
- Instruction to "ship", "deliver", "submit", or otherwise mark work as ready
- Final step of the
mobiai-fix-issuepipeline
When intent is explicit, proceed through the workflow — but still confirm before pushing (see "Never" below).
Implicit intent after completed work (user approves something you just finished): After you report a fix, review, or implementation as done, any user signal that the work is acceptable — approval, agreement, confirmation, green light, a simple "ok" in any language — is an implicit cue that the next action is probably to ship it. Do not act on implicit intent. Instead, ASK: propose creating the PR and wait for explicit confirmation. The language of your question should match the user's.
Distinguish implicit approval from continued discussion: if the user keeps asking questions, requests more changes, or is still evaluating, do not offer a PR yet.
Never:
- Act on implicit intent without asking — always confirm before pushing or opening a PR
- Commit directly to protected or long-lived branches (
main,master,develop,release/*,staging) — always move to a feature branch first - Push without explicit user confirmation
- Skip the changelog/README update step when the project has one
Workflow
Step 1: Prepare the Branch
- Check the current branch first. If you're on a protected or long-lived branch (
main,master,develop,release/*,staging), NEVER commit there — create a feature branch. Name it after the issue key:fix/<issue-key>,feat/<issue-key>, orchore/<description>:git checkout -b fix/<issue-key>
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 200 lines · 75 tokens per session scan A b9f7cb326a6c
mobiai-create-pr is a skill published in the GitHub repository ArisGuimera/MobiAI-Core (490 stars, last pushed 4d ago), licensed MIT. It adds 75 tokens to every session and 2,220 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
axiom-shipping
Use when preparing an app for App Store submission, handling rejections or appeals, managing App Store Connect and Xcode Cloud, or triaging TestFlight/Sentry crash corpora. Covers checklists, metadata, privacy manifests, age ratings, export compliance.
release-new-version
Use when the user wants to release a new Zafiro version — drafting bilingual release notes, deciding the next version number, bumping app/build.gradle.kts, tagging, and publishing to GitHub (main repo, optionally the Xposed repo).
asc-ad-hoc-distribution
Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned S3-compatible storage, or diagnosing a resumable private distribution run.
app-release
End-to-end pipeline for releasing an iOS / watchOS app to TestFlight and the App Store. Use when the user wants to publish, ship, or release an iOS/watchOS app, get a build onto TestFlight, archive and upload via xcodebuild, deploy a CloudKit schema to Production, set App Privacy or export compliance, mint a…
testflight-release
Ship a new TestFlight build of the iOS companion (TermioMobile) — resolve the next build number against App Store Connect, archive, sign, export, upload, write the What to Test notes, and distribute. Invoke when the user says 'ship a testflight build', 'update testflight', 'upload to testflight', 'new beta build'…
suede-play-release
Suede AI Google Play delivery skill: ship an Android release from the agent interface and prove what is live. Preflight the publishing credential with a real Play API call, upload an AAB to a testing track, promote that exact versionCode, stage or complete a rollout, write per-locale release notes, and read back…