Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/pjt222/agent-almanacnpx agentmods add skills/pjt222/agent-almanac/conduct-empirical-wire-captureWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pjt222/agent-almanac/conduct-empirical-wire-capture)<a href="https://agentmods.dev/skills/pjt222/agent-almanac/conduct-empirical-wire-capture"><img src="https://agentmods.dev/badge/skills/pjt222/agent-almanac/conduct-empirical-wire-capture/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pjt222/agent-almanac/conduct-empirical-wire-capture"><img src="https://agentmods.dev/badge/skills/pjt222/agent-almanac/conduct-empirical-wire-capture.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00117 | $0.03930 |
| Opus 5.5 | $0.00047 | $0.01572 |
| Sonnet 5.5 | $0.00023 | $0.00786 |
| Haiku 4.5 | $0.00012 | $0.00393 |
Grade A, and why
conduct-empirical-wire-capture scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Verbose-fetch stderr** — bundler-provided env var (e.g., bun's `BUN_CONFIG_VERBOSE_FETCH=curl`) routes every fetch to stderr. Noisy but captures every fetch. How it starts
The opening of the file, as written. The whole thing — 304 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Conduct Empirical Wire Capture
Set up a reproducible wire-capture harness for a CLI tool's outbound HTTP and telemetry, matching each observability target to the cheapest channel that captures it.
Scope and Ethics
Read this before configuring any capture.
- Wire capture is for your own requests against your own account, on your own machine. Capturing other users' traffic is exfiltration, not research, and is out of scope.
- Credentials almost always appear in raw wire output. Redact at capture time (Step 6) — never "capture now, redact later."
- Capture is observation, not modification. Do not use captured payloads to bypass server-side rate limits, replay another user's session, or activate a dark-launched capability without authorization.
- The output of this skill is an internal artifact. Public publication of wire findings goes through
redact-for-public-disclosure(Phase 5 of the parent guide), not this skill.
When to Use
- A static finding (a flag, an endpoint reference, a telemetry-event name) needs runtime confirmation that it actually fires.
- A payload shape is needed for a client re-implementation, a tracing instrumentation, or a cross-version diff.
- Dark-vs-live disambiguation requires watching what the binary actually sends, not what the bundle suggests it might.
- A behavior changed silently between versions and you want a reproducible artifact to compare against future versions.
Do not use this skill for: version baselining (use monitor-binary-version-baselines), flag-state probing (use probe-feature-flag-state), or preparing redacted artifacts for public publication (use redact-for-public-disclosure).
Inputs
- Required: A CLI harness binary you can run locally against your own account.
- Required: A specific question to answer (e.g., "does endpoint X fire on event Y?", "what is the payload shape for telemetry event Z?"). Capture without a question produces a log that nobody reads.
- Optional: Static findings from prior phases (marker catalog, candidate flag list, suspected endpoints) that scope the capture targets.
- Optional: A private workspace path for capture artifacts. Default is
./captures/— must be in.gitignore.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 304 lines · 117 tokens per session scan A 956ac7f1f1eb
conduct-empirical-wire-capture is a skill published in the GitHub repository pjt222/agent-almanac (39 stars, last pushed yesterday), licensed MIT. It adds 117 tokens to every session and 3,930 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
triage-issue
Verify an issue, persisted audit finding, or unresolved review finding against current code, classify it, and write only the contracted forge/ledger outcome. Supports independent batches and an immediate-fix review-finding route. Triggers: "triage-issue", "triage issue N", "triage this finding", "is this trigger met".
triage-issue-reports
Triage Slack issue reports with one thread-only verdict, evidence review, cause-aware routing, tracker dedupe, and fail-closed ticket creation. Use only from the configured Benny triage automation.
workers-profiling
Profile or debug CPU usage and memory allocation in deployed Cloudflare Workers and Durable Objects. Then use this information to optimize your code.
cocoreview
CocoReview — structured code review with six-severity findings vocabulary, progressive disclosure architecture, and universal anti-pattern baseline. Invoked via $review [file] [--complexity] [--security] [--architecture] [--language ].
stall-reset
Reset CocoStall counters after an operator-approved recovery.
stall-status
Report current CocoStall no-progress and loop state.