Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add patrickserrano/lacquer --skill xcsymgit clone --depth 1 https://github.com/patrickserrano/lacquerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/patrickserrano/lacquer/xcsym)<a href="https://agentmods.dev/skills/patrickserrano/lacquer/xcsym"><img src="https://agentmods.dev/badge/skills/patrickserrano/lacquer/xcsym.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.01000 |
| Opus 5 | $0.00041 | $0.00500 |
| Sonnet 5 | $0.00016 | $0.00200 |
| Haiku 4.5 | $0.00008 | $0.00100 |
Grade B, and why
xcsym scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
2. If not found, stop and tell the user to build it: `git clone --depth 1 https://github.com/CharlesWiltgen/Axiom /tmp/axiom-src && cd /tmp/axiom-src/tools/xcsym && go build -o xcsym . && sudo mv xcsym /usr/local/bin/` ( How it starts
The opening of the file, as written. The whole thing — 45 lines — stays where its author put it; the contents beside it link to each section on GitHub.
xcsym — Crash Symbolication
xcsym parses a crash report end-to-end (detect format → discover dSYMs → symbolicate via atos → categorize into a pattern_tag) and emits token-lean JSON, so triage is one call instead of the manual atos/dSYM-hunting dance. Use it instead of raw atos or symbolicatecrash for any .ips, MetricKit, .crash, or .xccrashpoint input — this fleet has no other crash-symbolication path today; native-app-profiling/swiftui-expert-skill cover live Instruments profiling, not post-mortem crash files.
Resolving the binary
xcsym is not bundled with FlowDeck or RocketSim and ships no Homebrew formula or GitHub release — it's a zero-dependency Go module distributed as source inside CharlesWiltgen/Axiom (tools/xcsym/, MIT). Resolve it once per machine:
command -v xcsym— if found, use it.- If not found, stop and tell the user to build it:
git clone --depth 1 https://github.com/CharlesWiltgen/Axiom /tmp/axiom-src && cd /tmp/axiom-src/tools/xcsym && go build -o xcsym . && sudo mv xcsym /usr/local/bin/(or any directory onPATH). Do not attempt this yourself unless the user has already agreed to installing new tooling.
Don't confuse this with the full Axiom Claude Code plugin — this fleet deliberately did not adopt that (see docs/references.md); only the standalone xcsym binary is in use here.
Core workflow
crash is the default entry point — it does everything in one call:
xcsym crash path/to/report.ips
- Auto-detects
.ips(v1/v2), MetricKit JSON, legacy.crashtext, and.xccrashpointbundles (walksFilters/Filter_*/Logs/automatically, picks the most recent). - Output is compact single-line JSON by default; add
--humanfor terse prose, or pipe throughjqfor pretty-printing. - Only reach for
resolve(single-address lookup),find-dsym(UUID-driven dSYM search),list-dsyms(inventory), orverify(per-image UUID/arch diagnostics) whencrashfails or you need one specific sub-step — seereferences/xcsym-reference.mdfor their flags.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 45 lines · 82 tokens per session scan B 19d13c97c4f8
xcsym is a skill published in the GitHub repository patrickserrano/lacquer (3 stars, last pushed yesterday), licensed MIT. It adds 82 tokens to every session and 1,000 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
printing-press-polish
Polish a generated CLI to pass verification and become publish-ready. Runs diagnostics (dogfood, verify, scorecard, go vet, gosec), automatically fixes all issues (verify failures, static-analysis findings, dead code, descriptions, README, MCP tool quality), reports the before/after delta, and offers to publish. Use…
printing-press-amend
Amend a published CLI from one of two input sources: (1) dogfood mode mines the active Claude Code session transcript for friction (missing flags, hand- rolled API payloads, silent-null returns); (2) direct-input mode accepts user-supplied asks (rename a command, add commands or feeds, fix a named bug, optionally…
printing-press-output-review
Internal sub-skill: agentic review of a printed CLI's sampled command output for plausibility issues that rule-based checks can't encode (substring-match relevance, format bugs, silent source drops, ranking failures). Invoked via the Skill tool by the main printing-press skill at Phase 4.85 and printing-press-polish…
refactor
Use when refactoring, cleaning up code, reducing complexity, fixing code smells, or improving code quality. Audits code for dead code, nesting, and patterns.
superplan-debug
Use when tracked work hits a failing check, flaky result, runtime bug, or unexplained behavior and you need root cause before changing code.
expo-troubleshooting
Common Expo errors: Metro cache, version mismatch, expo-doctor, Pod install, Gradle daemon, native module conflicts, EAS Build logs, dependency hoisting. Triggers on expo error, metro cache, version mismatch, expo-doctor, expo install check, pod install error, gradle error, native module not found, build failed, eas…