Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bolivian-peru/os-moda --skill flight-recordergit clone --depth 1 https://github.com/bolivian-peru/os-modaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bolivian-peru/os-moda/flight-recorder)<a href="https://agentmods.dev/skills/bolivian-peru/os-moda/flight-recorder"><img src="https://agentmods.dev/badge/skills/bolivian-peru/os-moda/flight-recorder/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bolivian-peru/os-moda/flight-recorder"><img src="https://agentmods.dev/badge/skills/bolivian-peru/os-moda/flight-recorder.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.00704 |
| Opus 5 | $0.00014 | $0.00352 |
| Sonnet 5 | $0.00005 | $0.00141 |
| Haiku 4.5 | $0.00003 | $0.00070 |
Grade A, and why
flight-recorder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Flight Recorder — Server Black Box
Continuous state capture for post-incident forensics.
Snapshot Capture (run every 5 minutes via heartbeat)
Capture a lightweight system snapshot:
system_health()
shell_exec({ command: "ps aux --sort=-%mem | head -10" })
shell_exec({ command: "ss -s" }) # connection summary
Store as a compact memory entry:
memory_store({
summary: "Flight recorder: CPU 12%, RAM 4.1G, load 0.3, 142 connections",
detail: "Top processes: postgres 1.2G, openclaw 380M, node 210M. Net: 142 established, 12 listening.",
category: "system.config",
tags: "flight-recorder,snapshot,telemetry"
})
Post-Incident Analysis
When investigating "what happened at 3 AM":
1. Pull flight recorder snapshots
memory_recall({ query: "flight-recorder snapshot", timeframe: "24h", max_results: 50 })
2. Pull journal logs for the incident window
journal_logs({ since: "2 hours ago", priority: "warning", lines: 100 })
3. Pull audit ledger
event_log({ limit: 50 })
4. Reconstruct the incident
Present a forensic timeline:
Incident Report — Server Crash at 03:12 UTC
Timeline:
02:00 Flight recorder: CPU 15%, RAM 5.2G (normal)
02:30 Flight recorder: CPU 23%, RAM 5.8G (rising)
02:47 Flight recorder: CPU 89%, RAM 7.1G (critical)
02:47 OOM killer triggered (killed: postgres worker)
02:48 PostgreSQL: 3 connections terminated
02:49 App health check failed → Caddy returned 502
02:51 systemd restarted PostgreSQL automatically
02:52 All services recovered
02:55 Flight recorder: CPU 12%, RAM 4.1G (normal)
Root cause: PostgreSQL autovacuum on users table (12M rows)
during traffic spike. Memory peaked at 7.4/7.6 GB.
Recommendations:
1. Add 2GB swap (NixOS config change)
2. Schedule autovacuum for low-traffic hours
3. Consider 16GB RAM plan ($6/mo more on Hetzner)
All data sourced from flight recorder snapshots,
journal logs, and audit ledger. Chain verified.
Data Retention
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 92 lines · 27 tokens per session scan A f3f5a2e91f9c
flight-recorder is a skill published in the GitHub repository bolivian-peru/os-moda (117 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 27 tokens to every session and 704 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gateway-doctor
Use when diagnose and fix MCP gateway routing issues, health checks, and server connectivity problems. Use when working with gateway doctor.
devops-incident-responder
Use when actively responding to production incidents, diagnosing critical service failures, or conducting incident postmortems to implement permanent fixes and preventative measures.
analyzing-linux-elf-malware
Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x8664 and ARM ELF samples. Activates for requests involving…
analyzing-linux-kernel-rootkits
Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (checksyscall, lsmod, hiddenmodules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
browser-edge-cases
SOP for debugging browser automation failures on complex websites. Use when browser tools fail on specific sites like LinkedIn, Twitter/X, SPAs, or sites with Shadow DOM.
ios-simulator
Verify and debug native, React Native, Expo, or Flutter apps on an iOS Simulator with agent-device. Use when an agent needs to launch an app, inspect its live UI, tap, type, scroll, validate a code change, collect failure evidence, or reproduce a workflow on an iPhone or iPad Simulator.