Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ComeOnOliver/skillshub --skill axiom-keychain-diaggit clone --depth 1 https://github.com/ComeOnOliver/skillshubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/comeonoliver/skillshub/axiom-keychain-diag)<a href="https://agentmods.dev/skills/comeonoliver/skillshub/axiom-keychain-diag"><img src="https://agentmods.dev/badge/skills/comeonoliver/skillshub/axiom-keychain-diag/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/comeonoliver/skillshub/axiom-keychain-diag"><img src="https://agentmods.dev/badge/skills/comeonoliver/skillshub/axiom-keychain-diag.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.05636 |
| Opus 5 | $0.00034 | $0.02818 |
| Sonnet 5 | $0.00013 | $0.01127 |
| Haiku 4.5 | $0.00007 | $0.00564 |
Grade A, and why
axiom-keychain-diag scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 360 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Keychain Diagnostics
Systematic troubleshooting for Security framework failures: uniqueness constraint violations, query mismatches, data protection timing, access group entitlements, disappearing items after updates, and Mac shim behavior differences.
Overview
Core Principle: When keychain operations fail, the problem is usually:
- Uniqueness constraint mismatch (errSecDuplicateItem) — 25%
- Query attribute confusion (errSecItemNotFound) — 25%
- Data protection / background timing (errSecInteractionNotAllowed) — 20%
- Access group / entitlement mismatch (errSecMissingEntitlement) — 15%
- Mac shim behavior differences — 10%
- Lost items after app update (entitlement or App ID prefix change) — 5%
Always dump existing items and compare attributes BEFORE changing keychain code.
Red Flags
Symptoms that indicate keychain-specific issues:
| Symptom | Likely Cause |
|---|---|
| errSecDuplicateItem when query returned not found | Non-unique attributes in add query — uniqueness is per-class + primary key attributes, not per your full query |
| errSecItemNotFound but item was just added | Wrong kSecClass, erroneous attribute narrowing query, or access group mismatch |
| errSecInteractionNotAllowed in background | kSecAttrAccessibleWhenUnlocked (default) + device locked + background execution |
| errSecMissingEntitlement | Access group not listed in keychain-access-groups entitlement |
| errSecNoSuchAttr | Attribute not supported for item class (e.g. kSecAttrApplicationTag on kSecClassGenericPassword) |
| errSecAuthFailed on Mac | File-based keychain locked or timed out |
| Items gone after app update | Access group or entitlement changed between versions |
| Items gone after team change | App ID prefix changed — items keyed to old prefix are inaccessible |
| SecItemDelete deleted everything | kSecMatchLimit is irrelevant for delete — it deletes ALL matching items |
| Keychain works in simulator, fails on device | Simulator does not enforce data protection — device does |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 360 lines · 67 tokens per session scan A 98b6648e9263
axiom-keychain-diag is a skill published in the GitHub repository ComeOnOliver/skillshub (63 stars, last pushed 2mo ago), licensed MIT. It adds 67 tokens to every session and 5,636 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
agent-introspection-debugging
Structured self-debugging workflow for AI agent failures using capture, diagnosis, contained recovery, and introspection reports. Use when an agent run fails and you need a reproducible diagnosis instead of a retry.
dx-audit
Audits libraries, CLIs, and SDKs using 38 rules for public contracts, package exports, piped output, errors, and configuration. Use when asked to "audit my CLI", "review my SDK", "make this agent-friendly", or diagnose package type resolution. For agentic product trust use ax-audit; for docs use docs-writing.
instance-performance-triage
Answer "the instance is slow" or "my nightly job never ran" from ServiceNow's own telemetry — transaction logs, syslog, systrigger, progress workers, execution trackers — instead of ad-hoc scripts that add to the load.
blast-radius
Trace ServiceNow configuration dependencies — what artifacts touch a given field, what calls a script include, table/app-level config inventory. Use before deletes, renames, or refactors.
incident-management
Manage ServiceNow incidents — creation with impact/urgency priority calc, auto-assignment by category, reassignment tracking, major incident declaration with bridge calls, time-based escalation, MTTR metrics.
problem-management
Manage ServiceNow problems — create from linked incidents, proactive pattern detection, RCA with 5-Whys, knownerror workarounds (KEDB), KEDB search by CI/category/keywords, and permanent-fix linkage to changes.