Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/gaelic-ghost/socket/devicecheck-app-attest-workflownpx skills add gaelic-ghost/socket --skill devicecheck-app-attest-workflowgit clone --depth 1 https://github.com/gaelic-ghost/socketWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gaelic-ghost/socket/devicecheck-app-attest-workflow)<a href="https://agentmods.dev/skills/gaelic-ghost/socket/devicecheck-app-attest-workflow"><img src="https://agentmods.dev/badge/skills/gaelic-ghost/socket/devicecheck-app-attest-workflow.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00126 | $0.02508 |
| Opus 5 | $0.00063 | $0.01254 |
| Sonnet 5 | $0.00025 | $0.00502 |
| Haiku 4.5 | $0.00013 | $0.00251 |
Grade A, and why
devicecheck-app-attest-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DeviceCheck App Attest Workflow
Purpose
Guide DeviceCheck and App Attest implementation decisions without confusing app-side Apple framework calls with server-side trust decisions.
The practical decision is whether the app needs DeviceCheck two-bit device state, App Attest app-instance integrity, both signals, or a different auth/session/sync workflow. The skill keeps Apple docs, Xcode signing state, server challenges, replay protection, rollout constraints, and backend handoffs visible before implementation starts.
When To Use
- Use this skill when adding or diagnosing
DCDevice,generateToken(completionHandler:), Apple DeviceCheck query/update/validate endpoints, or the two per-device bits Apple stores for an app. - Use this skill when adding or diagnosing
DCAppAttestService,generateKey(completionHandler:),attestKey(_:clientDataHash:completionHandler:),generateAssertion(_:clientDataHash:completionHandler:), orDCError. - Use this skill when the work involves App Attest App ID registration, DeviceCheck capabilities, the
com.apple.developer.devicecheck.appattest-environmententitlement, sandbox versus production behavior, TestFlight or App Store rollout, Enterprise distribution, Developer ID, or macOS signing validation. - Use this skill when the app and server need a challenge, attestation, assertion, receipt, public-key, counter, or fraud-risk metric contract.
- Use this skill when replacing custom device identifiers, local-only jailbreak checks, receipt-only abuse checks, or ad hoc risk flags with Apple-supported DeviceCheck or App Attest signals.
- Recommend
swift-openapi-client-workflowwhen the primary task is generated API client setup for the app-to-server transport. - Recommend
xcode-build-run-workflowwhen the next step is target setup, entitlements, signing, App ID capability wiring, build, run, simulator, device, or guarded Xcode project mutation. - Recommend
xcode-testing-workflowwhen the next step is repeatable XCTest, XCUITest, simulator/device matrix checks, or test-plan setup. - Recommend server-side Swift, OpenAPI, RPC, or backend-specific workflows when the primary task is implementing server verification, persistence, JWT generation, API routes, or fraud-risk policy.
- Recommend the broader client auth and sync workflow when the request is really Keychain storage, Sign in with Apple,
ASWebAuthenticationSession, token refresh, logout, multi-account state, or app sync.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 149 lines · 126 tokens per session scan A eeca77536ee9
devicecheck-app-attest-workflow is a skill published in the GitHub repository gaelic-ghost/socket (7 stars, last pushed 8d ago), licensed Apache-2.0. It adds 126 tokens to every session and 2,508 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
caveman
Persistent token-compression mode (75% reduction) — now always-on by default. Strips filler while keeping code exact.
authoring-workflows
当你要调用 Workflow 工具，或要写 / 调试 / 启动一个 Claude Code dynamic-workflow 脚本时用——author / debug / launch a Claude Code dynamic-workflow script，当你要写 workflow 脚本时——哪怕你自觉已经懂这套 API。当你发现自己在猜 workflow 引擎的 determinism 或 resume 规则、没查 shape 就伸手够 parallel() / pipeline()、想手写一个 validation linter、或刚被 harness 报错正要 relaunch 时用。先查再猜，别等跑挂了才来。.
installer-packs
Use when installing a model family from an installer pack, or when building/deriving a new pack from an upstream installer or a workflow JSON. Explains the manifest-driven packs/ system and tells you to invite the user to contribute new packs back upstream.
workflow-layout
Lay out and organize a ComfyUI workflow cleanly on the live panel canvas. Dependency-layered node placement with no overlaps, subgraphs, colored group boxes, and subgraph rail alignment. Use when asked to tidy / clean up / organize / arrange a workflow, add groups or subgraphs, fix overlapping nodes, or build a…
suede-deslop
Suede Slop Stop: Suede Labs context-aware anti-slop pass for finished prose. Find or remove generic filler, manufactured emphasis, false agency, and formulaic structure without flattening the author's voice. Use before copy, a README, an email, a social post, or a doc ships; after a long assisted-writing session; or…
suede-cold-email
Suede-owned B2B cold-email discipline for evidence-based personalization, subject lines, opening lines, concise bodies, one clear CTA, and bounded follow-up sequences. Use when writing or repairing outbound email to qualified prospects. NOT FOR: building or qualifying the prospect list (use suede-prospecting)…