What is demo-review-surface?

A static review-page guide creates a self-contained HTML or Markdown page that puts demo media beside its source specifications, QA results, screenshots, and evidence.

It is for reviewing demo videos, screenshots, storyboards, automated-test results, traces, and quality findings without loading external scripts or network content.

It gives people one place to judge what a demo proves, what failed, and what should happen next.

demo-review-surface — Skill for Codex by 45ck

Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo

git clone --depth 1 https://github.com/45ck/skill-harness

agentmods

npx agentmods add skills/45ck/skill-harness/demo-review-surface

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/45ck/skill-harness/demo-review-surface/github.svg)](https://agentmods.dev/skills/45ck/skill-harness/demo-review-surface)

Your own site

<a href="https://agentmods.dev/skills/45ck/skill-harness/demo-review-surface"><img src="https://agentmods.dev/badge/skills/45ck/skill-harness/demo-review-surface/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/45ck/skill-harness/demo-review-surface"><img src="https://agentmods.dev/badge/skills/45ck/skill-harness/demo-review-surface.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 65 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 491 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00065	$0.00491
Opus 5	$0.00032	$0.00246
Sonnet 5	$0.00013	$0.00098
Haiku 4.5	$0.00006	$0.00049

Measured 10d ago against content hash dcd3e5e2abfe, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

demo-review-surface scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packs/demo-production-skills/skills/demo-review-surface/SKILL.md · 58 lines

What it actually says

Demo Review Surface

Overview

Use this skill when a human needs to inspect demo media and its evidence together. Prefer generated HTML for desktop/app-browser review, and Markdown/TOON for CLI-only handoff.

Required Sections

summary: what the demo proves and what it does not prove
source: .demo.yaml, QA flow, spec, issue, or source artifact
media: rendered video, raw capture, poster, frame strip, or slideshow output
evidence: events, quality, verification, QA reports, screenshots, traces, analyzer bundles
findings: failed checks, warnings, stale artifacts, missing evidence
next action: approve, regenerate, cut down, fix source, or discard

HTML Constraints

Use one self-contained static .html file.
Use inline CSS only.
Do not load external scripts, fonts, images, media, analytics, or network resources.
Do not include <script>, iframe, object, embed, form, meta refresh, external src, external href, or browser storage/network APIs.
Embed small images only when safe; prefer relative links to large local media.
Link or name the canonical source artifact and issue.

Provenance

If the target repo has docs/artifacts/artifacts.manifest.json, add or update an entry with:

id
type: usually review-dashboard or evidence-pack
source
sourceHash when available
reviewSurface
evidenceLinks
status

Then run:

node scripts/check-artifact-manifest.mjs
node scripts/check-artifact-html-policy.mjs

Review Defaults

Desktop agent apps: generate HTML under generated/review/.
CLI/TUI: produce Markdown summary first; generate HTML only when useful.
CI: produce JSON/Markdown evidence indexes and avoid large media unless promoted.

Output

Name the generated path, source path, evidence paths, checks run, and any missing evidence.

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

agents/openai.yaml 214 B

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

10d ago First seen · 58 lines · 65 tokens per session scan A dcd3e5e2abfe

Subscribe to this mod's changes

demo-review-surface is a skill published in the GitHub repository 45ck/skill-harness (15 stars, last pushed 2mo ago), licensed MIT. It adds 65 tokens to every session and 491 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude Code Testing agents claude codex codex-cli developer-tools

do-it-verify

Use when selecting evidence for a delivery claim, regression fix, installation, or branch closeout.

tdwhere123/do-it · 24 tokens

typescript-sdk

Implement or modify TypeScript SDK behavior in @composio/core or shared TypeScript packages, including tools, toolkits, sessions, auth configs, connected accounts, modifiers, and generated SDK surfaces. Use for TS runtime/API work; pair with typescript-testing for verification and cross-sdk-parity when Python must…

ComposioHQ/composio · 67 tokens

bug-fixing

Fix defects in the Composio SDK repository with focused reproduction, root-cause analysis, regression tests, and narrow verification. Use when the user reports a bug, failing test, CI regression, runtime defect, or incorrect SDK behavior. Do not use for new feature design or broad refactors.

ComposioHQ/composio · 63 tokens

cli-e2e

Write, modify, or debug Docker-based Composio CLI end-to-end tests under ts/e2e-tests/cli, including binary invocation, fixture isolation, output assertions, and package manifests. Use for CLI E2E test suites only; use cli-command for CLI source implementation.

ComposioHQ/composio · 62 tokens

python-providers

Create, modify, test, or package Python provider adapters under python/providers, including framework-specific dependencies, public imports, type inference, and provider metadata. Use for Python provider work only; use python-sdk for core SDK changes.

ComposioHQ/composio · 49 tokens

python-sdk

Implement or modify Python SDK behavior under python/composio, including tools, toolkits, sessions, auth configs, connected accounts, client integration, and shared Python models. Use for Python core runtime/API work; pair with python-testing and cross-sdk-parity when TypeScript must match.

ComposioHQ/composio · 60 tokens