Borrowing it
Nothing to install: this file belongs to xiaolai/claudepot-app. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/xiaolai/claudepot-app/main/.claude/commands/design-review.mdgit clone --depth 1 https://github.com/xiaolai/claudepot-appWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/xiaolai/claudepot-app/design-review)<a href="https://agentmods.dev/commands/xiaolai/claudepot-app/design-review"><img src="https://agentmods.dev/badge/commands/xiaolai/claudepot-app/design-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/xiaolai/claudepot-app/design-review"><img src="https://agentmods.dev/badge/commands/xiaolai/claudepot-app/design-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.01172 |
| Opus 5 | $0.00014 | $0.00586 |
| Sonnet 5 | $0.00006 | $0.00234 |
| Haiku 4.5 | $0.00003 | $0.00117 |
Grade A, and why
design-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Design Review
Audit the current UI diff against the paper-mono rules in
.claude/rules/design.md. Some checks are render-time properties a
diff cannot see — ask for a screenshot or a running build before
approving anything in that category.
Step 1 · Identify changed UI files
git diff --name-only -- 'src/**/*.tsx' 'src/**/*.css' 'src/**/*.ts' 'src/styles/**'
git diff --cached --name-only -- 'src/**/*.tsx' 'src/**/*.css' 'src/**/*.ts' 'src/styles/**'
If no UI files changed, report "No UI files modified" and stop.
Step 2 · Load the rules
Read .claude/rules/design.md and src/styles/tokens.css. That's
the full rule set — don't look anywhere else.
Step 3 · Read each diff
git diff HEAD -- <file> for each changed file. Read the full diff.
Step 4 · Check against the rules
Score every finding as BLOCK or WARN.
BLOCK
- Raw CSS values. Any hex/rgb/hsl/oklch literal, numeric
fontSize/padding/margin/gap/width/height/borderRadius/zIndex/
opacity, raw shadow, raw duration — in any file under
src/outsidetokens.cssandApp.csscomponent classes. Grep:
Allowed literals:rg -nE "(#[0-9a-fA-F]{3,8}\b|(rgba?|hsla?|oklch)\s*\()" \ --glob '!src/styles/tokens.css' --glob '!src/App.css' src/ rg -nE "(fontSize|padding|margin|gap|width|height|borderRadius|lineHeight|zIndex|opacity):\s*['\"]?[1-9]" \ --glob '!src/styles/tokens.css' --glob '!src/App.css' src/ | rg -v "var\(--"0, percentages, keywords (auto,inherit,transparent,currentColor),fr/calc()/minmax(), font weights (400/500/600/700). - Extra
:root { }block. Tokens are declared exactly once, intokens.css. Grep must return zero:rg -n ":root\s*\{" src/ --glob '!src/styles/tokens.css' - Token re-declaration in
App.css. Grep must return zero:rg -n "^\s*--(accent|bg|surface|border|text|ok|bad|warn|focus-ring|shadow|font|dur-|ease-|selection|chrome|grouped-bg)\b" src/App.css - Off-system icon source or emoji. Icons come only from
lucide-react, routed through<Glyph g={NF.x} />(theNF.*map insrc/icons.tsis the semantic name → Lucide component shim, kept from the older Nerd Font pipeline). Noheroicons,@phosphor-icons, Font Awesome, hand-authored SVGs, or emoji in the UI. - Internal identifier on a primary surface. DB keys, slugs,
UUIDs, internal paths — must be behind
DevBadgeor removed. - Destructive action without inline consequence. Verb-and-count label, one-line hint next to the button, friction matching blast radius. Confirmation copy repeats the verb.
- Status spray. Same state fires in more than one surface (toast + banner, or running-op strip + toast while running).
- Credential rendered or logged in full. Always truncated.
window.confirm / alert / promptanywhere.- Modal missing ARIA.
role="dialog",aria-modal,aria-labelledby, Escape handler, focus trap.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 108 lines · 28 tokens per session scan A 3482bd46ad55
design-review is a command published in the GitHub repository xiaolai/claudepot-app (119 stars, last pushed 4d ago), licensed ISC. It adds 28 tokens to every session and 1,172 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
vercel-linear
Linear's product design team and Vercel's Design Engineering team are doing the final design audit before this product ships.
audit-accessibility
Audit iOS app for accessibility compliance.
profile
Save, load, inspect, update, reset, or delete diagram-design client profiles.
vibe-agents
Step 4 of the vibe-coding workflow: generate AGENTS.md + tool configs so the AI builder stays on track.
ui-flow-review
Review menus, HUD, navigation, and player flow from a UX perspective.
ppt-image2-editable-rebuild
Rebuild image2 or imagegen reference slides as editable PowerPoint decks.