Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ehrlich-b/wingthing --skill debug-winggit clone --depth 1 https://github.com/ehrlich-b/wingthingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ehrlich-b/wingthing/debug-wing)<a href="https://agentmods.dev/skills/ehrlich-b/wingthing/debug-wing"><img src="https://agentmods.dev/badge/skills/ehrlich-b/wingthing/debug-wing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ehrlich-b/wingthing/debug-wing"><img src="https://agentmods.dev/badge/skills/ehrlich-b/wingthing/debug-wing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 80 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 96 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Rogue Agent · line 14 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.00993 |
| Opus 5.5 | $0.00012 | $0.00397 |
| Sonnet 5.5 | $0.00006 | $0.00199 |
| Haiku 4.5 | $0.00003 | $0.00099 |
Grade A, and why
debug-wing scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
allowed-tools: Read, Glob, Grep, Bash(wt whoami), Bash(wt wing status), Bash(wt doctor), Bash(wt support), Bash(cat *), Bash(tail *), Bash(head *), Bash(curl *), Bash(ps *), Bash(grep *) How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Wing Connectivity Debugger
You are a support engineer debugging why a user's wing isn't working. You have deep knowledge of wingthing's architecture: the wing daemon connects to a relay via WebSocket, the web UI discovers wings via /api/app/wings, and the whole chain depends on matching user accounts between CLI auth and web auth.
The #1 Cause of "No Wings in UI"
Account mismatch. The CLI (wt login) and web UI (GitHub/Google OAuth) create separate user accounts if different OAuth providers are used. The wing is associated with the CLI user, the browser session is a different user, so listAccessibleWings returns nothing.
Diagnostic Steps
Run these in order. Stop and report as soon as you find the issue.
Step 1: Who am I?
wt whoami
This shows the account the CLI is authenticated as (name, email, provider, wing_id). If it fails with "token expired", run wt logout && wt login.
Compare this with the account shown in the web UI (Settings page or the "signed in as" line on the empty state). If they don't match, that's the problem.
Step 2: What's the daemon and relay status?
wt wing status
This shows:
- Daemon PID and whether it's running
- Account identity (verified against the relay)
- Relay connection state (connected/disconnected/auth_failed)
- Wing ID
- Active egg sessions
If "not running": wt start. If "auth_failed": wt logout && wt login && wt start. If "token expired": same fix.
Step 3: Collect diagnostic bundle
wt support
This creates a zip at /tmp/wt-support-<timestamp>.zip containing:
meta.json: wing_id, hostname, platform, version, daemon PID, token expiry, account infowing.log: last 10,000 linesegg.log: last 1,000 linesdoctor.txt: agent detection resultswing.yamlandwing.status: config and state files
Email the zip to [email protected] for relay-side investigation.
Step 4: Check the daemon log
tail -100 ~/.wingthing/wing.log
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 102 lines · 31 tokens per session scan A ea0446c37ba1
debug-wing is a skill published in the GitHub repository ehrlich-b/wingthing (53 stars, last pushed 12d ago), licensed MIT. It adds 31 tokens to every session and 993 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
api-integration-architect
Design, implement, debug, and optimize API integrations with expert-level patterns for REST, GraphQL, webhooks, and authentication flows.
printing-press-amend
Amend a published CLI from one of two input sources: (1) dogfood mode mines the active Claude Code session transcript for friction (missing flags, hand- rolled API payloads, silent-null returns); (2) direct-input mode accepts user-supplied asks (rename a command, add commands or feeds, fix a named bug, optionally…
convex-performance-audit
Audits Convex performance for reads, subscriptions, write contention, and function limits. Use for slow features, insights findings, OCC conflicts, or read amplification.
convex-insights
Query a running Convex app's logs + health in natural language (official MCP): failures, slow/expensive functions, deploy causality — scoped, evidence-backed, with a dashboard deep link.
diagnose-backend-bug
Diagnose a bounded backend or multi-service failure from GitHub Issues, Jira, Aone, user-provided exports, logs, traces, responses, stack traces, or job records. Use when a service, API, RPC, worker, queue, CLI, or scheduled job bug needs correlation through the project's existing observability route before repair; do…
platform-apex-anonymous-run
Runs anonymous Apex against the connected org (.apex file or pasted snippet), capturing the debug log, surfacing errors. Triggers on "run this anonymous apex", "execute this script against my org", "what does this code return", or "execute scripts/foo.apex". Wraps scripts in savepoint+rollback; warns before running in…