Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/appclawhq/appclaw/review-changesnpx skills add appclawhq/AppClaw --skill review-changesgit clone --depth 1 https://github.com/appclawhq/AppClawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/appclawhq/appclaw/review-changes)<a href="https://agentmods.dev/skills/appclawhq/appclaw/review-changes"><img src="https://agentmods.dev/badge/skills/appclawhq/appclaw/review-changes.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00104 | $0.01366 |
| Opus 5 | $0.00052 | $0.00683 |
| Sonnet 5 | $0.00021 | $0.00273 |
| Haiku 4.5 | $0.00010 | $0.00137 |
Grade A, and why
review-changes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Changes
This skill reviews code changes in AppClaw to catch breakage across two surfaces (CLI and VSCode extension) and validate YAML flow parsing. AppClaw has a fragile contract between these surfaces — the CLI emits NDJSON events that the extension parses, and changes to either side can silently break the other.
Why this matters
AppClaw has three main failure modes when code changes:
- CLI ↔ Extension drift — The CLI's
src/json-emitter.tsdefines event types. The extension'svscode-extension/src/bridge.tsmirrors those types manually. When someone adds a field to one side, the other silently ignores it, causing subtle bugs. - YAML flow parsing regressions — Natural language parsing in
src/flow/natural-line.tsuses regex patterns that interact in surprising ways. A change to one regex can break another flow format. - Config drift — The CLI reads env vars via
src/config.ts(Zod schema). The extension maps VS Code settings to env vars inbridge.ts:getEnvFromSettings(). New config options added to one side may not appear in the other.
Review process
When triggered, perform these checks in order:
Step 1: Identify what changed
Run git diff (staged + unstaged) and git diff --cached to see all pending changes. Categorize the changed files:
- Shared contract files (high risk):
src/json-emitter.ts,src/flow/types.ts,src/config.ts - CLI-side flow files (medium risk):
src/flow/natural-line.ts,src/flow/parse-yaml-flow.ts,src/flow/run-yaml-flow.ts,src/flow/variable-resolver.ts,src/flow/llm-parser.ts - Extension files (medium risk): anything under
vscode-extension/src/ - Other files (lower risk): agent, perception, vision, etc.
Step 2: Cross-surface consistency check
If any shared contract files changed, or if extension/CLI files changed:
Event type check:
- Read
src/json-emitter.ts(theJsonEventtype union) - Read
vscode-extension/src/bridge.ts(theAppclawEventtype and individual event interfaces) - Compare every event variant — field names, types, optional vs required
- Flag any mismatch (missing fields, type differences, new events not mirrored)
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 135 lines · 104 tokens per session scan A 349899bed9f7
review-changes is a skill published in the GitHub repository appclawhq/AppClaw (110 stars, last pushed yesterday), licensed Apache-2.0. It adds 104 tokens to every session and 1,366 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mobile-automation
Control Android and iOS devices, emulators and simulators — launch apps, tap, swipe, type, take screenshots, read the accessibility tree. Use when a task involves a mobile device or app, mobile UI testing, or reproducing a bug on a phone.
deploy-release
Prepare and verify a staged or production deployment with rollback and smoke checks.
mobile-tester
You are the Mobile Tester Specialist. You connect to real Android/iOS devices and write, execute, and report on mobile UI test cases. You master THREE testing modalities.
flutter-cherry-pick
How to land a formal cherry-pick of a merged PR for the flutter/flutter repo stable or beta channel. Only use for flutter/flutter landed pull requests. Only use when the cherry pick request is into "stable", "beta" or a branch that has the format with flutter- . -candidate.0.
upgrade-browser
Upgrade browser versions (Chrome or Firefox) in the Flutter Web Engine and/or Framework tests. Use when asked to roll or upgrade Chrome or Firefox to a newer version.
natural-writing
Contains well-defined rules for creating natural, accurate, and readable writing. Use whenever authoring longer text, like analysis documents, PR or CL descriptions, or documentation.