Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add PatilShreyas/debroid --skill debroid-cligit clone --depth 1 https://github.com/PatilShreyas/debroidWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/patilshreyas/debroid/debroid-cli)<a href="https://agentmods.dev/skills/patilshreyas/debroid/debroid-cli"><img src="https://agentmods.dev/badge/skills/patilshreyas/debroid/debroid-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/patilshreyas/debroid/debroid-cli"><img src="https://agentmods.dev/badge/skills/patilshreyas/debroid/debroid-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Rogue Agent · line 212 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- medium Excessive Agency · line 134 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Data Exfiltration · line 159 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.05893 |
| Opus 5.5 | $0.00024 | $0.02357 |
| Sonnet 5.5 | $0.00012 | $0.01179 |
| Haiku 4.5 | $0.00006 | $0.00589 |
Grade A, and why
Debroid CLI Debugger scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://raw.githubusercontent.com/PatilShreyas/debroid/main/skills/debroid-cli/references/reporting-feedback.md How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Debroid CLI Debugger Skill
This skill provides mandatory instructions for AI agents to use the debroid CLI for headless Android debugging. Follow these instructions strictly to avoid context window bloat and execution errors.
🎯 Trigger Conditions
Activate this skill whenever the user or task involves:
- Debugging an Android application or process live
- Setting line breakpoints in Kotlin or Java source files (
debroid break) - Catching uncaught or caught runtime exceptions (
debroid catch-exception) - Inspecting live variables, object memory, or Jetpack Compose state (
debroid locals,pause-state,inspect) - Stepping through Kotlin/Java code execution (
debroid step) - Monitoring field access or modifications with watchpoints (
debroid watch) - Evaluating expressions or mutating variable values in runtime memory (
debroid eval,set-var)
⚠️ Critical Agent Rules (DO NOT IGNORE)
- Always use
--with-stacktracewhen polling to get immediate context. - Never poll in an infinite loop. Poll once or twice, and if the app hasn't hit a breakpoint, instruct the user to interact with the app.
- Parse JSON outputs carefully. All CLI outputs are JSON strings. Extract
sessionId,threadId,objectId,breakpointId,exceptionBreakpointId,watchpointId, andcontinuationIdexactly as provided and reuse them verbatim in subsequent commands. Do not synthesize IDs. - Track trap IDs and remove them when done. Every
break,catch-exception, andwatchreturns an ID. Useremove-break,remove-catch-exception,remove-watchto clear traps you no longer need so they don't fire unexpectedly and waste poll cycles. - Keep IDs in working memory, not in long scratch buffers. A typical session uses 1–3 trap IDs plus 1 thread ID — keep them inline.
- Use Background Tasks: If you are using an agentic system that supports background tasks, run
debroid daemonas a background task. - Token efficiency & Schema Inspection: All JSON responses are compact single-line by default to conserve agent context tokens. If formatted multi-line JSON is required, append the
--prettyflag to any JSON command. To inspect the expected output JSON structure for any command without running a session, pass the--schemaflag (e.g.,debroid pause-state --schema). Do not echo full responses back to the user verbatim — summarize the relevant fields (valuePreview,type,objectId,location). - Self-Recovery: If a session becomes unresponsive or gets out of sync, run
debroid stopto cleanly terminate the daemon and release ADB ports. The nextdebroidcommand will auto-restart a fresh daemon. - Report, but don't block: If you hit unexpected Debroid behavior or have feedback on the tool itself, first try to resume the flow of what the user originally wanted to perform. Do not immediately jump to reporting the issue. At the end of your task, ask the user if they want to report the issue. See "🐛 Reporting Bugs & Feedback" below for details.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago Changed · +1 lines 6beefd6729ae
- 1mo ago Changed 81422bf63ac2
- 1mo ago Changed · +2 lines 6c0c394ad881
- 1mo ago First seen · 211 lines · 61 tokens per session scan A 97c58cfa48ae
Debroid CLI Debugger is a skill published in the GitHub repository PatilShreyas/debroid (276 stars, last pushed 9d ago), licensed Apache-2.0. It adds 61 tokens to every session and 5,893 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
flutter
Use when building, structuring, testing or optimizing a Flutter app — feature-first layering, Riverpod 3 or Bloc, typed gorouter, freezed models, a dio data layer, Material 3, jank hunting, widget/golden tests. Targets Flutter 3.44 / Dart 3.12. NOT React Native (that is react-native), NOT Compose Multiplatform (that…
flutter-error-handling
Implement functional repository error recovery with Either/Failure patterns in Flutter. Use when handling exceptions or dartz Either types in data flows; defer UI-only retry buttons.
systematic-debugging
Use when diagnosing this Android app bugs, crashes, or unexpected UI behavior. Requires explicit hypotheses before code changes.
android-ui-journey-testing
XML-specified Android UI journey testing, interactive step execution, assertion verification, and JSON outcome reporting.
ios-simulator
Verify and debug native, React Native, Expo, or Flutter apps on an iOS Simulator with agent-device. Use when an agent needs to launch an app, inspect its live UI, tap, type, scroll, validate a code change, collect failure evidence, or reproduce a workflow on an iPhone or iPad Simulator.
argent-metro-debugger
Debug a JS runtime via CDP using argent debugger tools. Primary path is React Native via Metro (iOS / Android / Vega); a subset of the tools (debugger-connect, debugger-status, debugger-evaluate, debugger-log-registry) also drive a Chromium (CDP) app's renderer (an Electron app, or any Chromium browser exposing CDP)…