Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ccoalm/ccl-skills/web-react-devnpx skills add ccoalm/ccl-skills --skill web-react-devgit clone --depth 1 https://github.com/ccoalm/ccl-skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00181 | $0.05482 |
| Opus 5 | $0.00090 | $0.02741 |
| Sonnet 5 | $0.00036 | $0.01096 |
| Haiku 4.5 | $0.00018 | $0.00548 |
Grade A, and why
web-react-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Web React Dev
Use this skill for React web client engineering. It covers browser-rendered React applications, React components, routing, data fetching, forms, frontend API integration, accessibility, performance, build, and deploy checks. It does not own mini-program host behavior, Flutter, native mobile, backend service design, or visual design system rules.
Routing
- Use
product-rd-workflowfirst when the work spans product, design, architecture, implementation, testing, review, and release. - Use
product-ui-ux-designbefore or alongside coding for interaction model, layout, visual hierarchy, density, states, and UI acceptance. - Use
miniapp-product-devfor WeChat/Alipay/Douyin/Baidu mini-program pages, host-platform APIs, developer tools, review submission, and release. For React/H5 embedded inside a mini-program webview, this skill owns the React page whileminiapp-product-devowns the mini-program shell, bridge, host capabilities, and review/release evidence. - For Taro projects (React syntax compiled to mini-program runtime): this skill owns the React layer (component decomposition, hooks, state ownership, effect discipline, accessibility primitives) and the pure shared layer in the repo's established shared module: DTOs, types, validators, pure mapping functions.
miniapp-product-devowns Taro lifecycle hooks (useReady/useLoad/useDidShow/useDidHide),Taro.*runtime APIs, platform branching (process.env.TARO_ENV, conditional compilation, platform-specific files), subpackage configuration, host capability adapters, multi-target build invocation, host review/release, and rendered mini-program evidence.- Shared runtime adapters that mini-program targets consume are co-owned with a named final-decision owner per adapter, recorded in the repo. The adapter list and the miniapp acceptance-gate enumeration are canonical in
miniapp-product-dev(theShared runtime adapters consumed by mini-program targetsrow under## Sibling Boundary With web-react-dev); that gate is blocking and its miniapp contract tests must pass before mini-program targets import the adapter. Web sets browser semantics and cannot merge an adapter change that is browser-safe but mini-program-unsafe. Do not re-add a fixed kill-switch dimension list here: the owner's safety contract names the property (fail-closed flag evaluation) and its release contract makes each host platform's gray-release mechanism its own contract, so the dimensions a given adapter needs come from that platform's contract, not from a list on this side. Before merging an adapter change, the merge record must carry the canonical row's gate token and a passing miniapp-contract run recorded on the change under merge (rule canonical in that row); a merge record without the token, or asserting mini-program-safety without the contract run, is a violation. - When shared code must run in both web and mini-program targets, keep
react-dom, DOM mutation, browser observers (IntersectionObserver/ResizeObserver/MutationObserver), RAF/layout APIs, and other browser globals out of the shared layer; use Taro cross-platform equivalents at the consumer side.
- Use
app-cross-platform-devfor Flutter, React Native, native Android, native iOS, app store release, and device-native capability work. - Use Go or Python backend skills for API/service ownership, persistence, auth services, queues, and server contracts.
- For backend HTTP integrations, preserve current client wire behavior unless an explicit consumer-migration decision exists. Classify JSON vs protobuf-backed HTTP using
../platform-service-connectivity/references/protobuf-http-contract-signals.md.- First decide whether the client diff touches the HTTP contract or wire behavior. Wire-unchanged UI/component/state work does not need a backend owner round-trip and must not claim backend contract conformance.
- For unrelated client work, classify the diff with the canonical gate. If the surface is out of scope, client work may continue without claiming backend contract conformance.
- If the canonical gate classifies the diff as in scope, confirm the backend's recorded wire format or route back to the backend contract owner.
- Routine JSON/OpenAPI changes use the existing API contract record and do not require backend wire-format confirmation when the canonical reference classifies the surface as out of the protobuf wire-format gate.
- Client API wrappers must consume the backend contract's recorded response envelope per
../platform-service-connectivity/references/http-response-envelope-contract.md: for surfaces on the canonicalcode/message/dataenvelope, components and domain state read typed business data fromdata; other shipped or non-JSON envelopes are consumed per their recorded contract. Read only fields present in the recorded contract — do not infer business fields from unrecorded top-level or fallback shapes — and scatter no duplicate envelope parsing across the client. - If backend wire-format evidence is unreachable for an in-scope surface, stop at
pending-contract-owner, name the backend owner or owning repo, record the attempted lookup, and set the next escalation path. An assumed-wire-format note never unblocks merge. The blocker clears only when a checkable owner record, quoted prior backend record, or explicit migration decision is available; if no owner responds within the team's review SLA, keep the client change blocked or downscope the touched wire-format surface and record the dropped surface as an open owner-routed gap. Do not claim backend contract conformance or completion for the removed slice. - Do not fork IDL or hand-maintain duplicated DTOs in the web repo.
- Use
testing-strategyto choose unit/component/API/E2E layers; return here for React-specific implementation. - Use
test-artifact-managementwhen the ask is about generating structured test cases from a Feishu requirements doc or codebase and tracking them in Feishu Bitable before implementation begins. - Use
defect-diagnosisfirst for failed tests, browser bugs, hydration/rendering issues, flaky UI, API integration symptoms, or production regressions. - For money, quota, permission, tenant/user data, high-impact AI, repeated submit, async finality, or support-traceable incidents, apply
product-rd-workflowhigh-risk resilience gates before treating the UI as complete.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 129 lines · 181 tokens per session scan A 282c45dd66c9
web-react-dev is a skill published in the GitHub repository ccoalm/ccl-skills (5 stars, last pushed 2d ago), licensed Apache-2.0. It adds 181 tokens to every session and 5,482 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…