Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/spinabot/brigade/bluebubblesnpx skills add spinabot/brigade --skill bluebubblesgit clone --depth 1 https://github.com/spinabot/brigadeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/spinabot/brigade/bluebubbles)<a href="https://agentmods.dev/skills/spinabot/brigade/bluebubbles"><img src="https://agentmods.dev/badge/skills/spinabot/brigade/bluebubbles.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00038 | $0.00989 |
| Opus 5 | $0.00019 | $0.00495 |
| Sonnet 5 | $0.00008 | $0.00198 |
| Haiku 4.5 | $0.00004 | $0.00099 |
Grade A, and why
bluebubbles scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
80% identical to bluebubbles — 21 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
BlueBubbles Actions
Overview
BlueBubbles is Brigade’s recommended iMessage integration. Use the message tool with channel: "bluebubbles" to send messages and manage iMessage conversations: send texts and attachments, react (tapbacks), edit/unsend, reply in threads, and manage group participants/names/icons.
Inputs to collect
target(preferchat_guid:...; also+15551234567in E.164 or[email protected])messagetext for send/edit/replymessageIdfor react/edit/unsend/reply- Attachment
pathfor local files, orbuffer+filenamefor base64
If the user is vague ("text my mom"), ask for the recipient handle or chat guid and the exact message content.
Actions
Send a message
{
"action": "send",
"channel": "bluebubbles",
"target": "+15551234567",
"message": "hello from Brigade"
}
React (tapback)
{
"action": "react",
"channel": "bluebubbles",
"target": "+15551234567",
"messageId": "<message-guid>",
"emoji": "❤️"
}
Remove a reaction
{
"action": "react",
"channel": "bluebubbles",
"target": "+15551234567",
"messageId": "<message-guid>",
"emoji": "❤️",
"remove": true
}
Edit a previously sent message
{
"action": "edit",
"channel": "bluebubbles",
"target": "+15551234567",
"messageId": "<message-guid>",
"message": "updated text"
}
Unsend a message
{
"action": "unsend",
"channel": "bluebubbles",
"target": "+15551234567",
"messageId": "<message-guid>"
}
Reply to a specific message
{
"action": "reply",
"channel": "bluebubbles",
"target": "+15551234567",
"replyTo": "<message-guid>",
"message": "replying to that"
}
Send an attachment
{
"action": "send",
"channel": "bluebubbles",
"target": "+15551234567",
"path": "/tmp/photo.jpg",
"message": "here you go"
}
Use message for the user-facing text. Do not rely on caption as a distinct BlueBubbles/iMessage feature.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 137 lines · 38 tokens per session scan A cdb54a20c333
bluebubbles is a skill published in the GitHub repository spinabot/brigade (3,389 stars, last pushed yesterday), licensed MIT. It adds 38 tokens to every session and 989 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 80% identical to bluebubbles, differing in 21 lines, and is treated as a copy.
Other skills, from other repositories
add-backend
Guide for adding a backend (Rust or Python) to the agent-sec-core security middleware. Use when creating new backends, integrating Rust or Python code into the security middleware, or extending with new backend actions.
code-scanner
扫描 Bash / Python 代码片段中的安全风险,返回结构化 JSON 扫描结果。当用户要求检查代码安全性时使用。.
code-mode-skill
Generate Python code instead of sequential tool calls (81-98% token savings).
javascript-skill
Execute JavaScript code for calculations, data processing, and JSON manipulation. Full ES6+ support with Node.js runtime.
python-skill
Execute Python code for calculations, data processing, and automation. Access to math, json, datetime, collections, and more.
monty-skill
Run AI-generated Python in a hard sandbox (Pydantic Monty) with enforced time + memory limits and opt-in capabilities. Use for untrusted code; supports a Python subset.