Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nitmi/blea/blenpx skills add Nitmi/blea --skill blegit clone --depth 1 https://github.com/Nitmi/bleaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00094 | $0.02206 |
| Opus 5 | $0.00047 | $0.01103 |
| Sonnet 5 | $0.00019 | $0.00441 |
| Haiku 4.5 | $0.00009 | $0.00221 |
Grade A, and why
ble scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
BLEA
Use BLEA for local BLE work. Prefer BLEA MCP tools when available; otherwise run the equivalent
ble CLI command with JSON output.
Environment boundary
First determine whether the current Agent host has BLEA MCP tools or the ble runtime and native
Bluetooth access. A hosted Agent cannot access the Bluetooth adapter on the user's computer merely
because this Skill is installed. In that environment, analyze uploaded .blea.jsonl evidence,
explain or prepare commands for a local host, and clearly label them as not executed. Do not claim a
scan, connection, read, notification, or write occurred without the corresponding structured
result.
When uploaded evidence is available but the BLEA runtime is not, parse the JSONL as structured JSON records, require a final complete summary before treating it as a complete capture, and report only the recorded advertisement, profile, read, notification, error, and cleanup evidence. Do not turn missing records into successful observations. Live operations require a local Agent host, the BLEA Python runtime, operating-system Bluetooth permission, and a supported adapter.
Diagnostic sequence
- Run
ble_doctororble doctor --jsonwhen adapter availability is unknown. - Scan and preserve the returned identifier, names, RSSI, advertised services, and raw advertising evidence.
- Select by exact identifier. Use an exact name only when one observed device has that name.
- Inspect the GATT profile before choosing characteristics.
- For event discovery, use bounded
ble_observe/ble observebefore writing; omit characteristics to observe all notify/indicate traits from the discovered profile. - When probing, continue with
next_read_offsetuntil it isnull.ok=truemeans the page ran; it does not mean every characteristic read succeeded. Aggregateread_page.success_count,failure_count, andfailure_reasonsacross pages, and preserve both successful reads and per-characteristic failures. - Prefer reads and bounded observation before considering a write. Treat a silent observation window as evidence only for that window, not proof that a characteristic never emits events.
- After the initial diagnosis, save a portable evidence package with
ble_captureorble capture. Use the exact resolved identifier, choose an explicit.blea.jsonloutput path, and set--redact-identifierswhen the package will leave the workstation. Capture is read-only: it records advertisements, the GATT profile, bounded readable-characteristic results, bounded notifications, operation errors, and a final integrity summary. It never writes, pairs, or changes configuration. Keep the file as the authoritative artifact and report its path plus summary status to the user. - Compare before/after captures offline with
ble_difforble diff. Keep the default identity guard for normal comparisons and useallow_different_devicesonly for an intentional cross-device comparison. Treat the 5 dBm RSSI tolerance as noise control; use strict RSSI only when exact signal samples matter. Diff never scans, connects, pairs, subscribes, or writes. - Reproduce captured behavior offline with
ble_replayorble replay. Use instant timing for Agent debugging and CI. Treatreplay_missas absent evidence, not device behavior, and do not infer a successful subscription from a notify property alone. Replay never accesses a physical adapter and never sends or simulates writes. - When one authorized write is expected to trigger notifications, use
ble_exchangeorble_session_exchange. These operations establish the subscription before writing and collect the response atomically; do not run standalone session subscribe and write tools concurrently. - Close the exact stateful MCP session once when the task is complete. Use
ble_session_listwhen cleanup is uncertain. Useble_session_close_allonly when a session ID is unknown, an explicit close failed, or leaked state must be recovered; do not call it after a successful close.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 138 lines · 94 tokens per session scan A dcbaa5f9cd40
ble is a skill published in the GitHub repository Nitmi/blea (10 stars, last pushed 22d ago), licensed MIT. It adds 94 tokens to every session and 2,206 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
beacio
Web Bluetooth SDK — scan, connect, read/write BLE devices from web apps (iOS Safari + Chrome).
beacio-developer
Guides extension development for beacio — the iOS Safari Web Extension that provides Web Bluetooth API support. Trigger when working on Swift CoreBluetooth code, BLE Safari extension internals, companion-app IPC relay, background sync, beacon scanning, Live Activities, simulator verification, Xcode MCP tools, or any…
beacio-developer
Guides extension development for beacio — the iOS Safari Web Extension that provides Web Bluetooth API support. Trigger when working on Swift CoreBluetooth code, BLE Safari extension internals, companion-app IPC relay, background sync, beacon scanning, Live Activities, simulator verification, Xcode MCP tools, or any…
beacio-sdk-consumer
Ship Web Bluetooth on iOS / iPhone Safari via the beacio SDK. Trigger when users ask about navigator.bluetooth, Web Bluetooth, GATT, BLE from a website on iPhone, Safari Web Extension for Bluetooth, @beacio/ packages, or connecting to BLE devices from a web page on iOS.
beacio
Web Bluetooth SDK — scan, connect, read/write BLE devices from web apps (iOS Safari + Chrome).
beacio-sdk-consumer
Ship Web Bluetooth on iOS / iPhone Safari via the beacio SDK. Trigger when users ask about navigator.bluetooth, Web Bluetooth, GATT, BLE from a website on iPhone, Safari Web Extension for Bluetooth, @beacio/ packages, or connecting to BLE devices from a web page on iOS.