Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add semantic-craft/iOS-vibebuddy --skill verify-vibebuddygit clone --depth 1 https://github.com/semantic-craft/iOS-vibebuddyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/semantic-craft/ios-vibebuddy/verify-vibebuddy)<a href="https://agentmods.dev/skills/semantic-craft/ios-vibebuddy/verify-vibebuddy"><img src="https://agentmods.dev/badge/skills/semantic-craft/ios-vibebuddy/verify-vibebuddy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/semantic-craft/ios-vibebuddy/verify-vibebuddy"><img src="https://agentmods.dev/badge/skills/semantic-craft/ios-vibebuddy/verify-vibebuddy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.02575 |
| Opus 5.5 | $0.00031 | $0.01030 |
| Sonnet 5.5 | $0.00015 | $0.00515 |
| Haiku 4.5 | $0.00008 | $0.00258 |
Grade C, and why
verify-vibebuddy scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
"$ctrl" approval --session-id vb-verify-ap --cwd /tmp/verify-gateway --tool Bash --command 'rm -rf /tmp/vibebuddy-verify-should-ask' How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verify VibeBuddy
VibeBuddy is a personal-use Mac, iPhone, and Apple Watch companion for Claude Code, Codex, Grok Build/Bot, and Cursor usage. Users touch native apps, not a website. The Mac is the hub: the menu-bar app embeds the same HTTP + WebSocket server as the headless vibebuddyd (docs/getting-started.md). Phones and hooks talk to that server with a bearer token (ADR-0009).
This skill drives an isolated vibebuddyd (the repo's documented headless path) and, on a Mac with simulators, the iPhone Demo. It does not replace /Applications, bind :9876, or write the login ~/Library/Application Support/vibebuddy/ token.
features/README.md maps each feature to its recipe; drive the mapped feature file, not a convenient substitute.
Helper (executable; invoke only via these paths):
ctrl="docs/agents/skills/verify-vibebuddy/helpers/control-vibebuddy"
Launch
Documented user/dev start for the hub:
swift run --package-path VibeBuddyMac vibebuddyd --pair # production-shaped; defaults to :9876
Verification start — isolated port, disposable HOME, never :9876:
export VERIFY_RUN_ID="${VERIFY_RUN_ID:-vb-$(date +%Y%m%dT%H%M%S)}"
export VIBEBUDDY_QA_PORT="${VIBEBUDDY_QA_PORT:-18765}" # must not be 9876
export VERIFY_EVIDENCE_DIR="${VERIFY_EVIDENCE_DIR:-$PWD/.scratch/verify-vibebuddy/$VERIFY_RUN_ID}"
"$ctrl" launch # or: "$ctrl" launch --pair
Ready when both are true:
GET http://127.0.0.1:$VIBEBUDDY_QA_PORT/healthreturnsok(unauthenticated).vibebuddyd: listening on 0.0.0.0:<port>is in the run'sdaemon.log.
The helper builds with swift build --package-path VibeBuddyMac --product vibebuddyd (Swift 6, macOS 14+, Xcode 26.6 / XcodeGen for the GUI apps — docs/getting-started.md#build-from-source). It restores VibeBuddyMac/Package.resolved after the build, matching tools/watch-live-qa.sh.
--pair opens the same 120-second registration window as Mac Pair a phone / vibebuddyd --pair.
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- features/cursor-hooks.md 2.8 KB
- features/cursor-managed-acp.md 6.0 KB
- features/dashboard-sessions.md 3.8 KB
- features/iphone-demo.md 3.4 KB
- features/phone-pairing.md 9.0 KB
- features/question-reply.md 3.9 KB
- features/README.md 3.3 KB
- features/remote-approval.md 4.3 KB
- helpers/control-vibebuddy 26 KB
- helpers/test-control-vibebuddy-doctor.py 3.9 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed a28bc6bf0ba4
- 1mo ago Changed 61e61ff936f0
- 1mo ago First seen · 150 lines · 77 tokens per session scan C c0ce6f023fb1
verify-vibebuddy is a skill published in the GitHub repository semantic-craft/iOS-vibebuddy (92 stars, last pushed 15d ago), licensed MIT. It adds 77 tokens to every session and 2,575 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-13.
Other skills, from other repositories
argent-test-ui-flow
Autonomously test an app UI (iOS or Android) by running interact-screenshot-verify loops using argent MCP tools. Use when testing UI flows, verifying login works, testing navigation, running UI test scenarios, manual QA steps, visible UI changes, or visual behavior.
mobile-automation
Control Android and iOS devices, emulators and simulators — launch apps, tap, swipe, type, take screenshots, read the accessibility tree. Use when a task involves a mobile device or app, mobile UI testing, or reproducing a bug on a phone.
baguette
Drive and inspect iOS simulators with the baguette CLI: taps, swipes, buttons, typing, screenshots, the accessibility tree, logs, and the conditions an app runs under (location, network, appearance, push, UserDefaults), without opening Xcode. Use when an agent must act on or verify a running simulator — a UI flow…
argent-qa-e2e
Write repeatable QA regression e2e tests from test cases, tickets, or acceptance criteria. Use when the user asks to write, automate, or generate an e2e test or preserve an automated regression scenario, with deterministic setup, stable targets, executable structural or visual evidence, and two consecutive full…
ios-simulator-skill
Build, test, and drive iOS apps in the Simulator with 30 token-efficient scripts. Use when asked to build or test an Xcode project, launch an app on a simulator, tap/type/swipe through its UI by accessibility label, take screenshots or visual diffs, audit accessibility, read logs or diagnose hangs, or manage…
argent-create-e2e
Create, record, edit, replay, or repair reusable Argent e2e test YAML files. Use when the user asks to record, replay, or run an e2e test or a repeatable device path, set up profiling or an A/B comparison, or invoke the authoring engine behind argent-qa-e2e. Also use before repeating three or more interactions. For…