Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nikships/droidproxy/releasenpx skills add nikships/droidproxy --skill releasegit clone --depth 1 https://github.com/nikships/droidproxyWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00080 | $0.01220 |
| Opus 5 | $0.00040 | $0.00610 |
| Sonnet 5 | $0.00016 | $0.00244 |
| Haiku 4.5 | $0.00008 | $0.00122 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DroidProxy Release
End-to-end release pipeline for DroidProxy macOS menu bar app.
Prerequisites
- Developer ID signing identity available in keychain
notarytoolkeychain profile named"notarytool"configured- Sparkle EdDSA signing key in keychain (used by
sign_update) ghCLI authenticated with push access toanand-92/droidproxy- On the
mainbranch with a clean working tree
Steps
1. Determine version
Check the latest git tag and the commits being released to decide the new semver:
git tag --sort=-v:refname | head -5
git log --oneline $(git describe --tags --abbrev=0)..HEAD
- New feature -> bump minor (e.g. 1.5.0 -> 1.6.0)
- Bug fix only -> bump patch (e.g. 1.5.0 -> 1.5.1)
- CLIProxyAPI bump alone -> bump patch
2. Bump version in Info.plist
Edit src/Info.plist and update CFBundleShortVersionString to the new version.
3. Build the app bundle
APP_VERSION=<version> ./create-app-bundle.sh
This does a release swift build from src/, assembles the .app bundle, signs everything
(cli-proxy-api, Sparkle.framework, main executable) with Developer ID, and verifies.
The build number (CFBundleVersion) is auto-set to git rev-list --count HEAD.
4. Notarize
ditto -c -k --sequesterRsrc --keepParent "DroidProxy.app" "DroidProxy-notarize.zip"
xcrun notarytool submit "DroidProxy-notarize.zip" --keychain-profile "notarytool" --wait
xcrun stapler staple "DroidProxy.app"
Wait for status: Accepted before proceeding. If rejected, fetch the log:
xcrun notarytool log <submission-id> --keychain-profile "notarytool"
5. Create distribution zip and sign with Sparkle
ditto -c -k --sequesterRsrc --keepParent "DroidProxy.app" "DroidProxy-arm64.zip"
src/.build/artifacts/sparkle/Sparkle/bin/sign_update DroidProxy-arm64.zip
Capture the sparkle:edSignature="..." and length="..." from the output.
6. Update appcast.xml
Add a new <item> block at the top of appcast.xml (after <language>en</language>):
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 132 lines · 80 tokens per session scan A b58b71c0e14a
release is a skill published in the GitHub repository nikships/droidproxy (120 stars, last pushed 2d ago), licensed MIT. It adds 80 tokens to every session and 1,220 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
harbofly-cleanup
Reclaim disk space on a macOS developer machine by finding and safely cleaning build caches and artifacts (Xcode DerivedData, nodemodules, Docker, and package-manager/editor/AI caches) with the Harbofly CLI. Everything goes to the Trash and is recoverable. Use when the user wants to free up disk space, clean dev…
poll-github-work
Poll and rank open GitHub issues, RFCs, and pull requests for maintainer work, or start one explicitly selected item. Use when a user asks what to work on, requests backlog priorities, says "poll work," wants actionable issues or pull requests, or says "start.
release-peekaboo
Peekaboo release: notarization, npm/GitHub release, appcast, verify, closeout.
scarf-template-author
Scaffold a new Scarf project OR enrich an existing one after a Scarf "Upgrade Project" — dashboard, optional configuration schema, optional cron job, AGENTS.md, and (via the scarf-miniapp-author skill) a starter mini-app — from a short conversational interview. Output is immediately usable locally and cleanly…
test
Run tests. Use after code changes to validate. Arguments: unit (default, no GPU), e2e (with models), filter name, or all.
ddg-apple-feedback-review
Invoke ONLY when the user explicitly runs /ddg-apple-feedback-review or names this skill by name. Do NOT auto-invoke from symptom/intent matching. If the user asks about Apple feedback, iOS or macOS issues, user reports, or feedback triage without naming this skill, answer directly instead.