Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add OpenMinis/MinisSkills --skill coredevice-toolkitgit clone --depth 1 https://github.com/OpenMinis/MinisSkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/openminis/minisskills/coredevice-toolkit)<a href="https://agentmods.dev/skills/openminis/minisskills/coredevice-toolkit"><img src="https://agentmods.dev/badge/skills/openminis/minisskills/coredevice-toolkit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/openminis/minisskills/coredevice-toolkit"><img src="https://agentmods.dev/badge/skills/openminis/minisskills/coredevice-toolkit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00185 | $0.02951 |
| Opus 5.5 | $0.00074 | $0.01180 |
| Sonnet 5.5 | $0.00037 | $0.00590 |
| Haiku 4.5 | $0.00018 | $0.00295 |
Grade B, and why
coredevice-toolkit scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **强制权限拦截**:严禁加载权限过宽(Group / Other 可读)的配对文件!若文件权限不符合 `chmod 600`(属主独占只读/读写),底座将主动抛出 `PermissionError` 拒绝启动并提供阻断修复指引; How it starts
The opening of the file, as written. The whole thing — 146 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CoreDevice RSD 极客工具箱 (iOS 单机开发者中枢)
本 Skill 将原本必须通过 USB 数据线连接 Mac/Xcode 才能调用的苹果底层开发者特权(CoreDevice RSD 加密隧道),通过 Surge 本地回环反射 + 纯用户态网络协议栈 完整搬迁至 iPhone 单机内部。
一、 前置准备与环境要求
- 系统版本:
- 已实测验证 (Verified):iOS 18.0+(包含当前真机环境);
- 实验性支持 (Experimental):iOS 17.0 ~ 17.7(因部分小版本系统 remoted 守护进程可能仅监听 IPv6 Link-Local 或存在端口漂移,欢迎社区测试反馈);
- 需在系统【设置 ➡️ 隐私与安全性】中开启「开发者模式」;
- 本地回环基建:Surge 启用
10.7.0.1 = reflect与tun-included-routes = 10.7.0.1/32(详见 Surge 回环配置指南); - 配对文件:手机与电脑配对生成的
.plist文件或 SideStore 配对文件(详见 配对文件指南); - 一键初始化:在终端运行
sh /var/minis/skills/coredevice-toolkit/scripts/setup.sh,自动安装依赖并将全套 CLI 注册至全局路径。
二、 架构原理:单机莫比乌斯环 🔌🔄
┌────────────────────────────────────────────────────────────────────────┐
│ iPhone 单机内部 (Non-Jailbroken) │
│ │
│ [ 应用层 / CLI 工具: cdtk-* ] │
│ │ │
│ ▼ │
│ coredevice_session.py (CoreDeviceSession 异步上下文管理器) │
│ │ │
│ ├── Node.js TLS-PSK 桥接 (通过 stdin 安全投递 PSK,0 命令行泄露) │
│ ▼ │
│ pmd-pytcp (纯用户态 TCP/IP 协议栈,无 root 免虚拟网卡拨号) │
│ │ │
│ ▼ │
│ 发往 10.7.0.1:49152 (目标:本地开发者配对服务) │
│ │ │
│ ▼ │
│ Surge IP Rewrite (10.7.0.1 = reflect 本地反射回环) │
│ │ │
│ ▼ │
│ iOS 系统内核守护进程: remoted / launchd (85 大官方 Remote Services) │
└────────────────────────────────────────────────────────────────────────┘
What ships with it
13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/PAIRING_GUIDE.md 2.4 KB
- references/SURGE_LOOPBACK.md 3.8 KB
- scripts/cdtk-crash 7.5 KB
- scripts/cdtk-ctrl 7.2 KB
- scripts/cdtk-diag 4.7 KB
- scripts/cdtk-fs 6.5 KB
- scripts/cdtk-inspect 3.3 KB
- scripts/cdtk-install 10 KB
- scripts/cdtk-profile 8.9 KB
- scripts/cdtk-springboard 3.9 KB
- scripts/coredevice_session.py 14 KB runs code
- scripts/setup.sh 2.3 KB runs code
- scripts/tls_psk_proxy.js 2.3 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 146 lines · 185 tokens per session scan B 3ee572e94dda
coredevice-toolkit is a skill published in the GitHub repository OpenMinis/MinisSkills (502 stars, last pushed 2d ago), licensed MIT. It adds 185 tokens to every session and 2,951 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-19.
Other skills, from other repositories
developer-device-platform-basics
Provides guidance and instructions on managing remote devices on Developer Device Platform (DDP). Use when reserving remote Android devices, establishing connection tunnels, checking session status, or extending/cancelling leases. Don't use for iOS or local device/hardware inquiries.
camerax
Provide technical guidance for Android camera development with CameraX. Use when implementing camera features, handling asynchronous recording lifecycles, wiring low-level hardware interop using CameraX, or integrating ML Kit or Media3 effects.
mobile-platform-native-capabilities-integrate
Build a Salesforce LWC that uses native mobile device capabilities — barcode scanner, biometrics, location, NFC, calendar, contacts, document scanner, geofencing, AR space capture, app review, and payments. Use this skill when the user asks for an LWC that scans a barcode, captures a photo of a document, reads…
wifi-skill
Control Android WiFi - enable, disable, get status, scan for networks, and get current connection info.
audio-skill
Control Android audio - get/set volume, mute/unmute for media, ringtone, notification, and call volumes.
battery-skill
Monitor Android device battery status, level, charging state, temperature, and health.