Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add FoloToy/ai-passport --skill passport-device-testgit clone --depth 1 https://github.com/FoloToy/ai-passportWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/folotoy/ai-passport/passport-device-test)<a href="https://agentmods.dev/skills/folotoy/ai-passport/passport-device-test"><img src="https://agentmods.dev/badge/skills/folotoy/ai-passport/passport-device-test/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/folotoy/ai-passport/passport-device-test"><img src="https://agentmods.dev/badge/skills/folotoy/ai-passport/passport-device-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00828 |
| Opus 5.5 | $0.00017 | $0.00331 |
| Sonnet 5.5 | $0.00009 | $0.00166 |
| Haiku 4.5 | $0.00004 | $0.00083 |
Grade A, and why
passport-device-test scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Flash and Test on the Device
Locate the user's checkout; read AGENTS.md, the on-device handoff in
docs/development/ai-guide.md, and the flashing/data policy in
docs/development/engineering/firmware-layout.md. Use the applicable hardware
acceptance checklist, not every peripheral test for every change.
Establish access, artifact, and consent
- Discover ports read-only with the platform's enumeration tools; an activated
IDF Python can use
python -m serial.tools.list_ports -v. Do not open/reset arbitrary ports or assume the first port is the target. Resolve multiple or uncertain devices with the user. - If no device is detected, ask the user to turn it on and connect it to a computer USB port with a data-capable cable, then recheck after confirmation. In a remote/VM/WSL environment without access, say access is unavailable, not that the physical device is disconnected. Provide local steps if necessary.
- Bind the target device to an exact verified firmware and the user's data
requirements. For a gate-produced bundle run
python3 tools/archive_firmware.py verify <archive-directory>and compare the chosen image hash with its manifest. For other builds require equivalent target/layout evidence; do not assume any.binis a merged image. - Confirm the specific port, firmware, intended write range/data impact, and consent for this flash before writing. Existing explicit consent covering those facts need not be asked again. A build request, earlier-version approval, connected device, or publishing approval alone is insufficient.
Flash only the intended data
For an approved complete refresh, flash the verified merged image from 0x0
using the activated toolchain and the confirmed port. Check the installed
esptool's help for command spelling/options. An application-only binary never
belongs at 0x0.
If settings must survive, do not write the merged image blindly: confirm a
compatible partition layout and use verified component images at their actual
configured offsets. If that evidence or the matching components are missing,
stop and obtain them. Do not run a rebuild-and-flash command that silently
changes the artifact just approved. Treat flash_args as data, never execute it
as a shell script. Whole-chip erase is a separate destructive choice, not a
default repair. Backing up the original firmware is not a prerequisite.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 69 lines · 43 tokens per session scan A eb86ab9c6370
passport-device-test is a skill published in the GitHub repository FoloToy/ai-passport (646 stars, last pushed 2d ago), licensed MIT. It adds 43 tokens to every session and 828 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-17.
Other skills, from other repositories
jetson-video-pipeline
Use when planning, executing, and independently validating Jetson Video Codec SDK or PyNvVideoCodec encode/decode, transcode, segmentation, container decode, AV1, or concise acceptance workflows.
jetson-validate-image
Use after jetson-flash-image to run static BSP checks, on-target smoke/regression tests on a flashed DUT, or both. Not for build or flash steps. Triggers: validate bsp, on-target validation.
SmartHome Video Anomaly Benchmark
VLM evaluation suite for video anomaly detection in smart home camera footage.
holohub-app-lifecycle
Use for non-failing HoloHub app work with ./holohub: scaffold, build, run, test, visual evidence, lint, and flow benchmarking.
ros2-robotics
Best practices for ROS 2 robotics development, covering package structure, nodes, topics/services/actions, launch files, QoS, tf2 transforms, and testing. Use when creating ROS 2 packages, writing nodes in rclpy or rclcpp, defining custom messages/services/actions, writing launch files, configuring QoS profiles…
tia-testsuite
TIA Portal V21 Test Suite operations. Use for Application Tests with PLCSIM, Style Guide rules, System Tests through OPC UA, import/scope management, execution, and recursive result evaluation.