Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gaelic-ghost/socket --skill ios-runtime-forensics-workflowgit clone --depth 1 https://github.com/gaelic-ghost/socketWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gaelic-ghost/socket/ios-runtime-forensics-workflow)<a href="https://agentmods.dev/skills/gaelic-ghost/socket/ios-runtime-forensics-workflow"><img src="https://agentmods.dev/badge/skills/gaelic-ghost/socket/ios-runtime-forensics-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gaelic-ghost/socket/ios-runtime-forensics-workflow"><img src="https://agentmods.dev/badge/skills/gaelic-ghost/socket/ios-runtime-forensics-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.00758 |
| Opus 5.5 | $0.00022 | $0.00303 |
| Sonnet 5.5 | $0.00011 | $0.00152 |
| Haiku 4.5 | $0.00005 | $0.00076 |
Grade A, and why
ios-runtime-forensics-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
iOS Runtime Forensics Workflow
Purpose
Provide two explicit evidence modes for a reproducible iOS Simulator issue: performance-trace for focused ETTrace/symbolicated latency or CPU work, and memory-graph for retained-object and leak ownership analysis. This skill owns evidence shape, not normal app build, launch, or UI driving.
When To Use
- Use
performance-tracefor launch/runtime latency, CPU-heavy stacks, or comparison traces. - Use
memory-graphfor leaks, retain cycles, memory growth, or objects that should release after a known interaction. - Route simulator discovery, build, install, launch, logs, screenshots, and UI driving to
xcode-build-run-workflow.
Single-Path Workflow
- Apply the Apple docs gate through
explore-apple-swift-docs. Confirm the current Xcode/Simulator evidence mechanism before acting. - Define one reproduction, start/stop boundary, target app build, simulator UDID, OS, Xcode version, and expected release or latency behavior.
- Select exactly one mode:
performance-traceormemory-graph. Do not mix CPU and ownership conclusions in one unsupported capture. - For
performance-trace, readreferences/performance-trace-evidence.md, capture a focused trace with matching symbols, and identify hot stacks only after symbolication. - For
memory-graph, readreferences/memory-graph-evidence.md, drive the release-producing flow, capture a memgraph, inspect app-owned retained types, and follow ownership evidence to the retaining path. - Make the smallest root-cause change, then recapture the same flow on the same simulator where practical.
- Report the exact capture boundary, tool/version context, what the artifact proves, what it does not prove, and the before/after delta.
Inputs
- reproducible simulator flow, target app/scheme, simulator UDID, and build configuration
- expected release/lifetime or performance boundary
- mode:
performance-traceormemory-graph - existing trace, memgraph, logs, screenshots, or symbol files when available
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 59 lines · 54 tokens per session scan A 6dd52edca6fb
ios-runtime-forensics-workflow is a skill published in the GitHub repository gaelic-ghost/socket (7 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 54 tokens to every session and 758 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
bug-fix
Use when a bug, regression, or unexpected behaviour is reported and the user wants it fixed end to end — "why is X broken", "this stopped working after Y", "fix this crash". Also use when a symptom is known but its cause is not. Not for building new behaviour, and not for a change whose cause is already proven.
bug-investigate
Use when someone wants to know WHY something is broken and has not asked for it to be fixed — "why is this happening", "what's causing this error", "find out what's wrong", "diagnose this before we decide". Also use before committing to a fix, when the cause is unknown and the decision depends on it. Not for fixing …
operating-cadence
Designs the rhythm an organization runs on — which reviews happen weekly, monthly and quarterly, what each one decides, who owns the numbers presented, and how a signal at the front line reaches the people who can act on it. Use this to set up a management operating system, fix a meeting calendar that produces no…
serena
Serena code intelligence — LSP-powered symbol navigation, diagnostics, and targeted code surgery. Activate before complex refactors, cross-file analysis, or when graph tools need symbol-level depth.
diagnose
Structured 6-phase debugging. Build feedback loop first, reproduce deterministically, hypothesize with ranked falsifiable theories, instrument one variable at a time, fix with regression test, cleanup. Use when a bug exists, tests fail unexpectedly, or behavior is wrong and cause is unknown.
fix
Plan-aware auto-fix loop after coding. Runs tests, lint, format, and graph checks. Updates plan task status. Use after execute/tdd.