Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add trebormc/drupal-ai-agents --skill xdebug-profilinggit clone --depth 1 https://github.com/trebormc/drupal-ai-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/trebormc/drupal-ai-agents/xdebug-profiling)<a href="https://agentmods.dev/skills/trebormc/drupal-ai-agents/xdebug-profiling"><img src="https://agentmods.dev/badge/skills/trebormc/drupal-ai-agents/xdebug-profiling/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/trebormc/drupal-ai-agents/xdebug-profiling"><img src="https://agentmods.dev/badge/skills/trebormc/drupal-ai-agents/xdebug-profiling.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00203 | $0.02362 |
| Opus 5.5 | $0.00081 | $0.00945 |
| Sonnet 5.5 | $0.00041 | $0.00472 |
| Haiku 4.5 | $0.00020 | $0.00236 |
Grade C, and why
xdebug-profiling scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
ssh web rm -rf /tmp/xdebug/* Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
# Via curl inside web container (or Playwright with ?XDEBUG_TRIGGER=1) How it starts
The opening of the file, as written. The whole thing — 225 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Environment
All commands run via ssh web. Xdebug output is stored
inside the web container at /tmp/xdebug/. Use $DDEV_DOCROOT for paths.
Two Modes
| Mode | Use for | Output | Analysis |
|---|---|---|---|
| trace | Debug errors, trace execution path | .xt files (function calls, args, returns) |
Read trace, find error origin |
| profile | Performance bottlenecks, slow pages | cachegrind.out.* files |
Find slowest/most-called functions |
Setup (run once per session)
ssh web mkdir -p /tmp/xdebug
# Verify Xdebug is available — expected output: "xdebug"
ssh web php -m | grep -i xdebug
If the grep output is EMPTY, do not invent paths: ask the user to run ddev xdebug on on the HOST, then re-check.
After EVERY config change below, verify it took effect:
ssh web php -i | grep "xdebug.mode"
Workflow A: Trace Mode (Debug Errors)
Step 1: Enable trace
ssh web bash -c "
PHP_VER=\$(php -r 'echo PHP_MAJOR_VERSION.\".\".PHP_MINOR_VERSION;')
cat > /etc/php/\${PHP_VER}/fpm/conf.d/99-xdebug-custom.ini <<'EOF'
xdebug.mode=trace
xdebug.start_with_request=trigger
xdebug.output_dir=/tmp/xdebug
xdebug.trace_format=1
xdebug.collect_return=1
xdebug.collect_assignments=1
xdebug.trace_output_name=trace.%t.%p
EOF
kill -USR2 \$(pgrep -o php-fpm)
"
Step 2: Trigger the request
# Via curl inside web container (or Playwright with ?XDEBUG_TRIGGER=1)
ssh web curl -s -b 'XDEBUG_TRIGGER=1' 'http://localhost/the-page' -o /dev/null -w '%{http_code}'
Step 3: Analyze the trace
3a. Write the analyzer script ONCE per session (copy this block EXACTLY — the quoted 'EOF' prevents any variable expansion):
ssh web "cat > /tmp/analyze-trace.php" <<'EOF'
<?php
// Usage: php /tmp/analyze-trace.php /tmp/xdebug/trace.XXXX.xt
$lines = file($argv[1]);
$entries = []; $calls = [];
foreach ($lines as $line) {
$f = explode("\t", trim($line));
if (count($f) < 5) continue;
if ($f[2] === '0' && isset($f[5])) {
$entries[$f[1]] = ['name' => $f[5], 'start' => (float) $f[3], 'file' => $f[8] ?? '', 'line' => $f[9] ?? ''];
}
elseif ($f[2] === '1' && isset($entries[$f[1]])) {
$d = (float) $f[3] - $entries[$f[1]]['start'];
$n = $entries[$f[1]]['name'];
if (!isset($calls[$n])) {
$calls[$n] = ['count' => 0, 'total' => 0, 'file' => $entries[$f[1]]['file'], 'line' => $entries[$f[1]]['line']];
}
$calls[$n]['count']++;
$calls[$n]['total'] += $d;
}
}
uasort($calls, fn($a, $b) => $b['total'] <=> $a['total']);
printf("%-45s %6s %10s %s\n", 'Function', 'Calls', 'Time(s)', 'Location');
echo str_repeat('-', 90) . "\n";
foreach (array_slice($calls, 0, 25) as $n => $d) {
printf("%-45s %6d %10.4f %s:%s\n", substr($n, 0, 45), $d['count'], $d['total'], basename($d['file']), $d['line']);
}
EOF
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 225 lines · 203 tokens per session scan C 98e97a043ad9
xdebug-profiling is a skill published in the GitHub repository trebormc/drupal-ai-agents (11 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 203 tokens to every session and 2,362 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sentry-php-sdk
Full Sentry SDK setup for PHP. Use when asked to "add Sentry to PHP", "install sentry/sentry", "setup Sentry in PHP", or configure error monitoring, tracing, profiling, logging, metrics, crons, or AI monitoring for PHP applications. Supports plain PHP, Laravel, and Symfony.
wp-phpstan-static-analysis
Run PHPStan static analysis on a WordPress plugin or theme using szepeviktor/phpstan-wordpress. Covers the composer dev-dependencies and what is pulled transitively (phpstan/phpstan ^2.0, php-stubs/wordpress-stubs), the optional phpstan/extension-installer that auto-registers the extension, the phpstan.neon.dist…
php-quality-tooling
Use when setting up PHPStan, Rector, or PHP-CS-Fixer on a non-Laravel PHP project, incl. CI wiring. Do NOT use for Laravel (Pint/Larastan), tests, or syntax.
wp-phpstan
Use when configuring, running, or fixing PHPStan static analysis in WordPress projects (plugins/themes/sites): phpstan.neon setup, baselines, WordPress-specific typing, and handling third-party plugin classes.
bug-root-cause-finder
Root cause analysis methods for PHP bugs. Provides 5 Whys technique, fault tree analysis, git bisect guidance, and stack trace parsing.
check-cascading-failures
Detects cascading failure risks in PHP systems. Identifies shared resources, unbounded queues, missing backpressure, thread pool exhaustion, and failure propagation paths.