Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/robertguss/claude-code-toolkit/xcode-makefilesnpx skills add robertguss/claude-code-toolkit --skill xcode-makefilesgit clone --depth 1 https://github.com/robertguss/claude-code-toolkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00052 | $0.00450 |
| Opus 5 | $0.00026 | $0.00225 |
| Sonnet 5 | $0.00010 | $0.00090 |
| Haiku 4.5 | $0.00005 | $0.00045 |
Grade A, and why
xcode-makefiles scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Xcode Makefiles
Overview
Paul Solt [email protected] Version: 0.9.8
Install a focused Makefile + scripts toolkit into an existing or newly scaffolded Xcode project.
Canonical conventions:
AGENT_NAMEis the only agent env var.- Per-agent paths live under
build/:build/DerivedData/<AGENT_NAME>build/logs/<AGENT_NAME>build/cache/<AGENT_NAME>build/tmp/<AGENT_NAME>
Install
skills/xcode-makefiles/scripts/install.sh \
--project-dir /path/to/project \
--app-name WalkTrack \
--platform ios
Common flags:
--project-dir PATHrequired--mode install|upgradedefaultinstall--dry-runpreview changes only
Toolkit flags:
--app-name NAMErequired--platform ios|macosrequired--sim-name NAMEoptional, defaults toautofor iOS--namespace NAMEoptional, installsMakefile.NAMEandscripts/NAME/
Installed scripts include:
scripts/atomic_commit.shscripts/xcbuild.shscripts/resolve_agent_name.shscripts/resolve_sim_destination.shscripts/diagnose.shscripts/run_app_macos.shscripts/run_app_ios_sim.shscripts/clean.shscripts/move_to_trash.sh
Targets
Installed Make targets are intentionally minimal:
make diagnosemake buildmake testmake runmake build-and-runmake build-and-run-backgroundmake cleanmake agent-verify
What ships with it
13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- scripts/install.sh 3.7 KB runs code
- scripts/move_to_trash.sh 550 B runs code
- scripts/render_template.py 1.9 KB runs code
- templates/toolkit/Makefile 5.9 KB
- templates/toolkit/scripts/atomic_commit.sh 821 B runs code
- templates/toolkit/scripts/clean.sh 1.1 KB runs code
- templates/toolkit/scripts/diagnose.sh 861 B runs code
- templates/toolkit/scripts/move_to_trash.sh 550 B runs code
- templates/toolkit/scripts/resolve_agent_name.sh 682 B runs code
- templates/toolkit/scripts/resolve_sim_destination.sh 3.4 KB runs code
- templates/toolkit/scripts/run_app_ios_sim.sh 1.5 KB runs code
- templates/toolkit/scripts/run_app_macos.sh 1.4 KB runs code
- templates/toolkit/scripts/xcbuild.sh 3.6 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 66 lines · 52 tokens per session scan A e5bc8d79168b
xcode-makefiles is a skill published in the GitHub repository robertguss/claude-code-toolkit (108 stars, last pushed 24d ago), licensed MIT. It adds 52 tokens to every session and 450 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
offensive-tls-attacks
Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSLv2 export ciphers…
offensive-jwt
JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing…
revenuecat
Comprehensive assistance with RevenueCat in-app subscriptions and purchases.
google-mobile-ads-android-migrate-to-next-gen
Migrates Android applications from the old, legacy Google Mobile Ads (GMA) SDK (com.google.android.gms:play-services-ads) to the new GMA Next-Gen SDK (com.google.android.libraries.ads.mobile.sdk:ads-mobile-sdk). Provides comprehensive mapping tables for imports, classes, and method signatures to help determine…
developer-device-platform-basics
Provides guidance and instructions on managing remote devices on Developer Device Platform (DDP). Use when reserving remote Android devices, establishing connection tunnels, checking session status, or extending/cancelling leases. Don't use for iOS or local device/hardware inquiries.
firebase-basics
Provides foundational Firebase CLI setup, CLI installation, version checks (firebase-tools@latest --version), CLI login (including --no-localhost), project creation, project selection (firebase use), and app config file downloads (google-services.json, GoogleService-Info.plist). Use ONLY for CLI login, project…