Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aiopshwang/ship-mobile-app --skill ship-mobile-appgit clone --depth 1 https://github.com/aiopshwang/ship-mobile-appWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aiopshwang/ship-mobile-app/ship-mobile-app)<a href="https://agentmods.dev/skills/aiopshwang/ship-mobile-app/ship-mobile-app"><img src="https://agentmods.dev/badge/skills/aiopshwang/ship-mobile-app/ship-mobile-app/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aiopshwang/ship-mobile-app/ship-mobile-app"><img src="https://agentmods.dev/badge/skills/aiopshwang/ship-mobile-app/ship-mobile-app.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.01856 |
| Opus 5 | $0.00051 | $0.00928 |
| Sonnet 5 | $0.00021 | $0.00371 |
| Haiku 4.5 | $0.00010 | $0.00186 |
Grade A, and why
ship-mobile-app scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 191 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ship Mobile App
Build the user path, not merely the code that resembles it.
A mobile change is complete only to the boundary actually observed. Source code, tests, debug builds, signed artifacts, store state, and behavior on a real device are different facts. Use the strongest practical evidence for the requested result, and label every untested layer honestly.
The general completion discipline here is shared with the goal-to-proof
skill; when both are installed, this skill supplies the mobile-specific
boundaries and goal-to-proof supplies the overall gate.
Frame the user loop
Inspect the repository and existing product before proposing a new architecture. Find the current screens, domain models, persistence path, backend contracts, platform configuration, release workflow, tests, and recent relevant failures. Classify existing pieces as reuse, extend, replace, or new.
For substantial work, determine:
- User scene: who is doing what, under which realistic conditions?
- Entry and action: how does the user reach and perform the behavior?
- Success: what can the user observe or do afterward?
- Recovery and return: how do they correct, undo, retry, or find it again?
- Non-goals: what is deliberately outside this change?
Do not let a requested screen, library, or implementation detail substitute for the underlying user problem when the mismatch would invalidate the result.
Trace the truth boundaries
Map only the boundaries touched by the request:
- Domain truth: the data means what its label and product behavior claim.
- State truth: local, optimistic, queued, committed, stale, and failed states remain distinguishable.
- Lifecycle truth: the behavior survives the relevant cold start, resume, background, deep-link, notification, permission, and account transitions.
- Platform truth: native configuration and the signed artifact contain what the runtime path needs.
- Claim truth: UI copy, AI output, analytics, privacy text, and completion reports never claim more than the observed state supports.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 191 lines · 103 tokens per session scan A cd22c9d532f6
ship-mobile-app is a skill published in the GitHub repository aiopshwang/ship-mobile-app (8 stars, last pushed 13d ago), licensed MIT. It adds 103 tokens to every session and 1,856 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
flutter
Use when building, structuring, testing or optimizing a Flutter app — feature-first layering, Riverpod 3 or Bloc, typed gorouter, freezed models, a dio data layer, Material 3, jank hunting, widget/golden tests. Targets Flutter 3.44 / Dart 3.12. NOT React Native (that is react-native), NOT Compose Multiplatform (that…
kotlin-android
Use when building or fixing a native Android app in Kotlin and Jetpack Compose on the UDF layered architecture — ViewModel/StateFlow, Hilt, Room, Retrofit, coroutines, type-safe Navigation, and the Gradle/AGP surface. NOT shared Android and iOS UI from one Kotlin codebase (that is compose-multiplatform).
react-native
Use when writing the JS/TS inside a React Native or Expo app — screens, Expo Router navigation, lists, Reanimated gestures, platform forks, offline state, native modules — or killing jank and render storms. NOT eas build/submit/OTA/config-plugin (that is expo), NOT a Dart app (that is flutter), NOT web React/DOM (that…
compose-multiplatform
Use when building one shared Compose UI in Kotlin across Android, iOS, and desktop — commonMain @Composables, expect/actual, source-set placement, native interop, multiplatform ViewModel/navigation/Koin. NOT a single-platform native build (that is kotlin-android / swift-ios), and NOT Dart/Flutter cross-platform UI…
reverse-engineering-android-malware-with-jadx
Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest permissions, receivers, services, and native libraries. Activates for requests…
modify-feature
Modify existing KMP features with spec-first workflow. Invoke with /modify-feature.