Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/rexleimo/aios/debug-hubnpx skills add rexleimo/aios --skill debug-hubgit clone --depth 1 https://github.com/rexleimo/aiosWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00066 | $0.01236 |
| Opus 5 | $0.00033 | $0.00618 |
| Sonnet 5 | $0.00013 | $0.00247 |
| Haiku 4.5 | $0.00007 | $0.00124 |
Grade B, and why
debug-hub scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
const __dh=async(m,d)=>{try{await fetch('http://127.0.0.1:39200/api/logs/single',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({id:crypto.randomUUID(),timestamp:Date.now(),level:'debug',m How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Debug-Hub
Working directory: any (scripts run from project root by convention)
Evidence-first debugging: inject zero-dependency log calls, collect via debug-hub HTTP API, analyze through MCP tools, strip all injected code when done.
Inline Reporter
Inject once at the top of the first file you modify. Node 18+ / modern browsers, zero npm deps:
const __dh=async(m,d)=>{try{await fetch('http://127.0.0.1:39200/api/logs/single',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({id:crypto.randomUUID(),timestamp:Date.now(),level:'debug',message:m,data:d,sdk:{name:'dh',version:'1',runtime:'node'}})})}catch{}}
Python target? Use the debug skill instead — it bundles a Python collector that sends to the same debug-hub API. This applies regardless of whether debug_hub MCP is available; the __dh helper is JavaScript-only.
Marker Convention
Every injected debug line carries DH:<sessionId>. Cleanup strips any line containing this string.
__dh('DH:sess-abc user state', {user});
__dh('DH:sess-abc payment duration', {ms: Date.now()-t0});
MCP Tools
| Tool | What it does |
|---|---|
debug_hub.start_session { objective } |
Start session, returns sessionId |
debug_hub.instrument { sessionId, files: [{path, lineCount}] } |
Track files with injected debug code |
debug_hub.search_logs { keyword, level, since, traceId } |
Query collected runtime logs |
debug_hub.get_stats |
Error counts, level breakdown |
debug_hub.cleanup_instruments { sessionId, dryRun?, workspace? } |
Remove all injected debug lines |
Other tools: list_traces, get_trace, compact_context, health — see MCP tool list.
When NOT to Use This Skill
Debug-hub is for runtime bugs where you can reproduce the issue and need to observe variable state, timing, or control flow at runtime. Do NOT use debug-hub for:
- Compile-time / type errors: TypeScript type errors, syntax errors, lint failures — read the error message and fix the code directly. No runtime injection needed.
- CI/CD platform differences: Path separators, case sensitivity, missing dependencies in CI — inspect CI logs and config files, not runtime state.
- Configuration / matching rule problems: Skill trigger conflicts, wrong config values, permission misconfig — read and fix the config files directly.
- Non-JavaScript environments: The
__dhhelper requires Node 18+ or browserfetch. For Python, use thedebugskill (bundled Python collector) instead. For other languages, use platform-native debug tools.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 88 lines · 66 tokens per session scan B 794d003e83ec
debug-hub is a skill published in the GitHub repository rexleimo/aios (52 stars, last pushed 3d ago), licensed MIT. It adds 66 tokens to every session and 1,236 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (sends data to an external url). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codexkit-legal-due-diligence
Conduct structured legal due diligence for M&A, joint ventures, or investment transactions. Cover all 9 workstreams — Corporate, Contracts, IP, Litigation, Regulatory, Employment, Tax, Environmental, and Data Privacy. Produce a risk matrix with deal-breaker flags and closing conditions. Use when evaluating a target or…
codexkit-a-b-test-planner
Design rigorous A/B test plans with hypothesis, sample size calculation, Minimum Detectable Effect (MDE), randomization strategy, and decision rules. Includes guardrail metrics and rollout playbook. Use when planning product experiments, conversion optimization, or data-driven feature decisions.
codexkit-audit-readiness-checker
Assess organizational readiness for financial audits (internal or external). Map assertions to account balances, check evidence completeness, score readiness using a Red/Amber/Green framework, and generate a remediation timeline. Aligned with SOX, IFRS, and GAAP audit standards. Use before scheduled audits or when…
codexkit-data-quality-auditor
Audit data quality across six DAMA DMBOK dimensions — Completeness, Accuracy, Consistency, Timeliness, Validity, Uniqueness. Produces a scored data quality report with issue log and remediation plan. Use when profiling datasets, onboarding new data sources, or building data quality gates.
codexkit-compliance-gap-review
Compare policies, procedures, onboarding files, or operating evidence against a named compliance framework such as AML/KYC, privacy, internal controls, or audit readiness. Use when a team needs a gap matrix, control checklist, remediation priorities, or evidence request list. Do not use when no target framework is…
codexkit-contract-risk-review
Review commercial contracts, NDAs, MSAs, SOWs, and vendor agreements for obligation clarity, risk allocation, termination, data handling, and negotiation red flags. Use when a user needs a structured contract summary, red flag list, fallback positions, or clause-by-clause review. Do not use as jurisdiction-specific…