Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tai2/aco/aconpx skills add tai2/aco --skill acogit clone --depth 1 https://github.com/tai2/acoWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00111 | $0.01012 |
| Opus 5 | $0.00056 | $0.00506 |
| Sonnet 5 | $0.00022 | $0.00202 |
| Haiku 4.5 | $0.00011 | $0.00101 |
Grade A, and why
aco scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Driving Appium with aco
aco issues one Appium WebDriver command per shell invocation against a live
session. Prerequisite: the user has aco (npm i -g @tai2/aco) and appium
installed. If aco --help fails, stop and tell the user to install it.
Core loop
- Discover a target (only when starting fresh):
aco device list(add--platform ios|android,--state all,--json). - Start a session — foreground blocks the shell, so ALWAYS pass
--detachso control returns:aco session start --detach --platform ios --app <path-or-bundleId> --device-name "<name>"Android needs--app-activitywhen--appis an appPackage id, and--avd(or a plugged-in device) to choose the target.session starthas no--jsonflag — it always emits the JSON envelope on stdout. Do not append--json(it errors); for verbatim W3C caps use--caps-json '<json>'instead. Do NOT unzip the build first. Pass the archive straight to--app: the driver extracts it itself. iOS accepts a.zip/.app.zip/.ipa(or an unzipped.app); Android accepts an.apk/.apks. Unzipping a.app.zipto a bare.appis unnecessary and a common mistake. - Inspect before acting — never guess coordinates:
aco elements→ labelled elements + ready-to-paste tap selectors (use--jsonto parse).aco screenshot --out shot.png, then Readshot.pngto see the screen.aco source(optionally--xpath '<expr>') for the full tree.
- Act —
--session/--server-url/--platformdefault to the latest live session, so omit them aftersession start:aco tap --selector 'accessibility id:login.button'(or--label, or--x/--y).aco swipe --direction up(within the default scroll view).aco send-keys --selector '<sel>' --text 'alice'(clears first;--no-clearappends).aco scroll-into-view '<selector>' --direction up.aco element find --using "accessibility id" --value "Login"thenaco element click --element <id>.
- Verify the effect with another
aco screenshot/aco elements. - Stop when done:
aco session stop(latest),--all, or--session <id>.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 72 lines · 0 tokens per session scan A f13d1f1f5c0f
aco is a skill published in the GitHub repository tai2/aco (2 stars, last pushed 2mo ago), licensed MIT. It adds 111 tokens to every session and 1,012 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
noqa-testing
Use this skill when the user wants to boot and interact with iOS or Android devices/simulators — inspect the screen, execute actions, generate or edit test cases, or run UI tests via the noqa platform.
bump-android-version
Use when bumping Maestro's Android compileSdk/targetSdk to a new API level and validating end-to-end against the test-e2e GHA workflow until the test-android job is green.
argent-test-ui-flow
Autonomously test an app UI (iOS or Android) by running interact-screenshot-verify loops using argent MCP tools. Use when testing UI flows, verifying login works, testing navigation, running end-to-end UI test scenarios, manual QA steps, visible UI changes, or visual behavior.
mobile-automation
Control Android and iOS devices, emulators and simulators — launch apps, tap, swipe, type, take screenshots, read the accessibility tree. Use when a task involves a mobile device or app, mobile UI testing, or reproducing a bug on a phone.
mobile-automation
MCP (dart-mcp + Marionette) を使ったFlutterアプリのE2E自動化・UI検証ガイド。シミュレーターでのUI動作確認、モックプレビュー検証、Bridge経由のE2Eテスト、スクリーンショット撮影など、アプリの動作検証が必要なときに使う。「動作確認して」「UIを検証して」「E2Eテスト」「シミュレーターで確認」「モックで確認」と言われたときや、UI変更後の検証フェーズで使用すること。.
argent-create-flow
Create, record, edit, replay, or repair reusable Argent flow YAML files. Use when the user asks to record or replay a repeatable device path, set up profiling or an A/B comparison, or invoke the authoring engine behind argent-qa-flows. Also use before repeating three or more interactions. For one-off UI checks…