Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add magnus919/agent-skills --skill meshcore-packet-capturegit clone --depth 1 https://github.com/magnus919/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/magnus919/agent-skills/meshcore-packet-capture)<a href="https://agentmods.dev/skills/magnus919/agent-skills/meshcore-packet-capture"><img src="https://agentmods.dev/badge/skills/magnus919/agent-skills/meshcore-packet-capture/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/magnus919/agent-skills/meshcore-packet-capture"><img src="https://agentmods.dev/badge/skills/magnus919/agent-skills/meshcore-packet-capture.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 102 Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.Fix: Remove privileged, hostPath, and host-namespace settings from workloads. Use a least-privilege securityContext, drop capabilities, and avoid mounting the host filesystem.
- medium Rogue Agent · line 96 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 100 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Privilege Escalation · line 103 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.02447 |
| Opus 5 | $0.00018 | $0.01223 |
| Sonnet 5 | $0.00007 | $0.00489 |
| Haiku 4.5 | $0.00004 | $0.00245 |
Grade B, and why
meshcore-packet-capture scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **NixOS:** use `services.meshcore-packet-capture` and rebuild with `sudo nixos-rebuild switch`. How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MeshCore Packet Capture
Use this skill when operating, configuring, deploying, or troubleshooting meshcore-packet-capture, especially requests involving Companion radios, BLE/serial/TCP capture, MQTT publishing, LetsMesh, TOML configuration, Docker, systemd, launchd, or NixOS.
Scope boundary
This project captures from MeshCore Companion radios only. Do not route repeater or RoomServer capture here; use meshcoretomqtt instead.
Operating workflow
- Identify the transport before changing configuration:
ble: direct address, device name, or general scan.serial: one or more serial ports; the runtime uses the first configured port.tcp: host and port, with SDK auto-reconnect enabled by default.
- Prefer the installed CLI:
For a checkout, usemeshcore-packet-capture --help meshcore-packet-capture --debugpython3 -m meshcore_packet_captureorpython3 packet_capture.py. Verified CLI boundary (v2.2.0): the parser exposes--output,--verbose,--debug,--no-mqtt, repeatable--config, and the neighbors on-demand pair--neighbors-now/--neighbors-exit(run one zero-hop neighbor discovery + scopes cycle immediately; with--neighbors-exit, quit when the cycle finishes). It does not expose--show-configor a dry-run flag. Run the exact installed binary with--helpbefore documenting or using any other flag; do not invent a configuration-preview command. - Configure one IATA code and at least one MQTT broker before expecting network uploads.
LOCis a placeholder, not a useful deployment identity. - Start with
--no-mqttwhen isolating radio connectivity. Add MQTT only after the device captures packets locally. - Verify the actual boundary after every change: device connection logs, packet output, broker connection, and service/container status. Do not treat a successful install as proof of a working capture.
Mutation gate: when the request is read-only or plan-only, do not present stop/start/edit/delete/restart commands as actions to perform. Describe future mutations separately, label every example as unexecuted, and require target, scope, and rollback confirmation before the first mutation.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 136 lines · 36 tokens per session scan B 309a04638404
meshcore-packet-capture is a skill published in the GitHub repository magnus919/agent-skills (76 stars, last pushed yesterday), licensed MIT. It adds 36 tokens to every session and 2,447 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
rosclaw-embodied
A set of rules for completing robot tasks in ROSClaw, a system for running and checking robot work. It covers approved robot files, acceptance evidence, and separate rules for simulation and real hardware.
modem-tune
Change the reported IMEI on a configured GL.iNet travel router (GL-XE300 or GL-E5800, auto-detected) for work testing. Generates a fresh, never-reused device-class IMEI locally (TAC from per-device config), connects to the modem over SSH, records the outgoing IMEI with a timestamp, applies the change, confirms the…
findmypipe
Locate Apple devices (iPhone, iPad, Mac, AirPods) via iCloud Find My using the findmy-agent CLI. Use this skill when the user asks to find an Apple device, check iPhone/iPad/Mac/AirPods location, locate lost AirPods, "Where's my iPhone", "Dov'è il mio Mac", verify if a device is home vs away, or check if devices are…
ev-car
Query EV car data — battery status, range, charging info.
camsnap
Capture frames or clips from RTSP/ONVIF cameras.
blucli
BluOS CLI (blu) for discovery, playback, grouping, and volume.