Borrowing it
Nothing to install: this file belongs to anantadwi13/explorer. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/anantadwi13/explorer/main/.claude/skills/record-demo-gif/SKILL.mdgit clone --depth 1 https://github.com/anantadwi13/explorerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anantadwi13/explorer/record-demo-gif)<a href="https://agentmods.dev/skills/anantadwi13/explorer/record-demo-gif"><img src="https://agentmods.dev/badge/skills/anantadwi13/explorer/record-demo-gif/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/anantadwi13/explorer/record-demo-gif"><img src="https://agentmods.dev/badge/skills/anantadwi13/explorer/record-demo-gif.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.02875 |
| Opus 5.5 | $0.00020 | $0.01150 |
| Sonnet 5.5 | $0.00010 | $0.00575 |
| Haiku 4.5 | $0.00005 | $0.00287 |
Grade D, and why
record-demo-gif scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
If `ffmpeg` is missing the script prints how to install it (`sudo apt-get install -y ffmpeg`). The first run installs the `ws` npm package into the skill folder; later runs reuse it. Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
CDP=$(curl -s http://127.0.0.1:9222/json | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{const t=JSON.parse(d);console.log(t.find(x=>x.type==='page').webSocketDebuggerUrl)})") Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
CDP=$(curl -s http://127.0.0.1:9222/json | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{const t=JSON.parse(d);console.log(t.find(x=>x.type==='page').webSocketDebuggerUrl)})") How it starts
The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Regenerate the README demos. Two GIFs are produced:
docs/desktop.gif— 1280×720 capture, scaled to 900px widedocs/mobile.gif— 390×720 capture, scaled to 320px wide
Both run at 12 fps and are encoded with an ffmpeg palettegen/paletteuse filter chain so the small file size doesn't smear text.
Quick start (no timeline changes)
From the repo root:
./.claude/skills/record-demo-gif/record.sh
That single command rebuilds the SPA, regenerates the deterministic testdata/sample-repo (a git repository — required so the git surface is active in the demo), starts a sandboxed explorer instance against it, drives a headless Chromium through the Chrome DevTools Protocol, captures PNG frames, and stitches them into the two GIFs. It cleans up its own background processes on exit.
If ffmpeg is missing the script prints how to install it (sudo apt-get install -y ffmpeg). The first run installs the ws npm package into the skill folder; later runs reuse it.
What's in each timeline
The recorded interactions live in record.mjs under two clearly-marked blocks:
// === DESKTOP TIMELINE ===— whatdesktop.gifshows// === MOBILE TIMELINE ===— whatmobile.gifshows
Edit those blocks to change scenes, then re-run record.sh.
Both demos run against testdata/sample-repo (regenerated on every run by scripts/sample-repo.sh) so the new git surface — branch picker, commits list, commit detail diffs, "N changes" badge — is active.
Current desktop sequence:
- Click
README.mdfrom the main folder listing → markdown renders. - Smooth-scroll the markdown, then snap back to top.
- Open the Settings popover → click Dark → click breadcrumb to dismiss.
- Click
logo.pngin the sidebar tree → binary image preview opens. - Click the branch picker (
main ▾) in the toolbar → click View commits → click the first commit → commit detail with file diff renders.
Current mobile sequence:
- Tap
README.mdfrom the listing → markdown renders. - Scroll, then snap back to top.
- Tap the hamburger (
Open folders) → drawer slides in. - Tap
logo.pngin the drawer tree → drawer auto-closes, image preview renders. - Re-open the drawer → tap the branch picker (now in the drawer header) → tap View commits → commits list renders.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 160 lines · 50 tokens per session scan D 21d81c5eedb1
record-demo-gif is a skill published in the GitHub repository anantadwi13/explorer (2 stars, last pushed 1mo ago), licensed MIT. It adds 50 tokens to every session and 2,875 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
moai-workflow-worktree
Git worktree management for parallel SPEC development with isolated workspaces, automatic branch registration, and seamless MoAI-ADK integration. Use when setting up parallel development environments.
moai-lane-watchdog
One lane stall watchdog iteration: measure lane progress on three channels, classify the stall cause, apply the remedy or resolve the judgment through the decision ladder — instead of waiting on a reply — then record the outcome and report. Reads the unified --auto doctrine at…
moai-workflow-thinking
Sequential Thinking MCP for structured step-by-step analysis via --deepthink flag. Separate from UltraThink which is Claude's native extended reasoning mode. Use for multi-step analysis or architecture decisions.
moai-ref-ui-polish
UI polish and interface-completion reference: the small visual details — concentric border radius, optical alignment, shadow-vs-border, motion easing, typography smoothing, tabular numbers, icon stroke weight, hit areas — that separate polished interfaces from generic ones. Agent-extending skill that amplifies…
moai-domain-uiux
UI/UX design systems specialist covering accessibility, icons, theming, design tokens, and user experience patterns. Use when working on design systems, WCAG compliance, ARIA patterns, or dark mode theming.
memstack-business-gdpr
Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR…