Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/cenconq25/claude-code-app-studio/code-reviewnpx skills add cenconq25/claude-code-app-studio --skill code-reviewgit clone --depth 1 https://github.com/cenconq25/claude-code-app-studioWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cenconq25/claude-code-app-studio/code-review)<a href="https://agentmods.dev/skills/cenconq25/claude-code-app-studio/code-review"><img src="https://agentmods.dev/badge/skills/cenconq25/claude-code-app-studio/code-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00046 | $0.01958 |
| Opus 5 | $0.00023 | $0.00979 |
| Sonnet 5 | $0.00009 | $0.00392 |
| Haiku 4.5 | $0.00005 | $0.00196 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 242 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review
Read-only quality pass over a recent change. Confirms the diff respects the project's coding rules, the governing ADR, and mobile-specific health checks (cold start, frame budget, memory, battery, deep-link surface).
Phase 1: Load Targets
Read the target file(s) in full. If a directory is given, glob it for source
files (*.ts, *.tsx, *.js, *.dart, *.swift, *.kt, *.kts,
*.java, *.m, *.mm).
Read CLAUDE.md and .claude/docs/coding-standards.md to refresh the active
project rules. Read .claude/docs/technical-preferences.md to capture frame
budget, cold-start budget, memory ceiling, and forbidden patterns.
Phase 2: Identify Framework Specialists
Open the ## Framework Specialists section of technical-preferences.md.
Note:
- Primary specialist (architecture and lifecycle calls).
- Language/UI specialist (RN screens, SwiftUI views, Compose composables, Flutter widgets).
- Native modules / platform channels specialist (bridges, JNI, Obj-C++).
- State management specialist (Redux, Riverpod, MVI, Combine, etc.).
If the section is [TO BE CONFIGURED], skip the framework-specialist phase.
Phase 3: ADR Compliance
Search the changed files (and any matching story file) for ADR references:
patterns like ADR-NNN, docs/architecture/ADR-, or
Governing ADR:. If none are found, log: "No ADR references found — ADR
compliance check skipped."
For each referenced ADR, read it and pull out the Decision and Consequences sections. Classify each deviation:
- BLOCKING — the code uses a pattern explicitly rejected by the ADR.
- DRIFT — the code diverges from the chosen approach without using a forbidden pattern.
- MINOR — small textual difference that does not change architecture.
Phase 4: Standards Compliance
For each target file, score these checks:
- All public APIs (exports, public methods, public protocols) carry doc comments.
- No method exceeds 40 lines (excluding data declarations).
- Cyclomatic complexity stays under 10 per method.
- Dependencies are injected; no module-scope singletons holding mutable app state.
- Tunable values come from config/remote config, not magic numbers.
- Modules expose interfaces (TS interface, Swift protocol, Kotlin interface, abstract Dart class) rather than concrete implementations.
- No hardcoded user-facing strings — all strings flow through the localization system.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 242 lines · 46 tokens per session scan A bdd01195e359
code-review is a skill published in the GitHub repository cenconq25/claude-code-app-studio (40 stars, last pushed 4mo ago), licensed MIT. It adds 46 tokens to every session and 1,958 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
play-policy-insights
Automated auditor designed to verify Android applications against Google Play Policy domains. It cross-references static code analysis with Play Store declarations to generate deterministic compliance reports, identifying undeclared data collection, architectural risks, and missing disclosures across Permissions and…
ios-hig-design
Design native iOS interfaces following Apple Human Interface Guidelines. Use when the user mentions "iPhone app", "iPad layout", "SwiftUI", "UIKit", "Dynamic Island", "safe areas", "HIG compliance", "SF Symbols", "haptic feedback", "iOS accessibility", "make my app feel native", or "follow Apple design guidelines".…
app-store-preflight-compliance
Pre-submission compliance scanner workflow for Apple App Store apps. Use when reviewing iOS, macOS, tvOS, watchOS, or visionOS projects (Swift, Objective-C, React Native, Expo) for App Store rejection risks, submission readiness, privacy compliance, or guideline violations.
app-store-review
Evaluates code against Apple's App Store Review Guidelines. Use this skill when reviewing iOS, macOS, tvOS, watchOS, or visionOS app code (Swift, Objective-C, React Native, or Expo) to identify potential App Store rejection issues before submission. Triggers on tasks involving app review preparation, compliance…
asc-privacy-nutrition-labels
Set up App Store privacy nutrition labels (data collection declarations) for an app. Use when the user needs to declare what data their app collects, how it's used, and whether it's linked to the user. Handles both "no data collected" and full data collection declarations.
gplay-submission-checks
Pre-submission validation for Google Play releases covering metadata, screenshots, bundle integrity, data safety, and policy compliance. Use when preparing a release to avoid rejections and catch issues before submitting.