AI DevKit is a local-first control layer that gives multiple AI coding agents shared configuration, a terminal dashboard, cross-agent messaging, local memory retrieval, and reusable engineering workflows. It is for developers and teams supervising agents such as Claude Code, Codex CLI, Gemini CLI, OpenCode, Pi, Cursor, Copilot, or Devin. The catalogue entries are composable skills and plugin components used within that agent-management system.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add codeaholicguy/ai-devkit --skill dev-smokegit clone --depth 1 https://github.com/codeaholicguy/ai-devkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/codeaholicguy/ai-devkit/dev-smoke)<a href="https://agentmods.dev/skills/codeaholicguy/ai-devkit/dev-smoke"><img src="https://agentmods.dev/badge/skills/codeaholicguy/ai-devkit/dev-smoke/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/codeaholicguy/ai-devkit/dev-smoke"><img src="https://agentmods.dev/badge/skills/codeaholicguy/ai-devkit/dev-smoke.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.00891 |
| Opus 5.5 | $0.00029 | $0.00356 |
| Sonnet 5.5 | $0.00015 | $0.00178 |
| Haiku 4.5 | $0.00007 | $0.00089 |
Grade A, and why
dev-smoke scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 43 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Smoke
Exercise the flows a change touches the way a user would, then throw the script away. Report with verify; use dev-testing for permanent tests.
Rules
- Drive the real entry point: built binary, running server, CLI, UI, or job. Imported functions and mocks are not smoke checks.
- Sandbox everything: temp dir, isolated
HOMEand config, empty git hooks, seeded test data, test accounts and tokens. - Never use production, shared environments, real accounts or credentials, or paid APIs. Ask before outward-facing side effects: messages, emails, webhooks, deploys, pushes.
- Start servers on a dedicated port, wait until they respond, and stop the whole process tree on exit. Never reuse or kill the user's own servers.
- Keep secrets out of the script and its output.
- Write the script outside the repo; commit it only if the user asks to promote it.
- Timebox setup. If the app cannot run locally, say what was not checked instead of faking a pass.
Workflow
- Read the change:
git diffagainst the base branch, plus untracked files. - Map impact outward: changed symbols -> callers -> entry points (commands, routes, screens, jobs, hooks, config, migrations) -> user flows. Add adjacent flows sharing the changed code, config, or data; note skipped flows and why.
- List scenarios as setup / action / expected result, ordered by risk. Wait for the user to add or cut flows; when running unattended, proceed and include the list in the report.
- Search memory for known setup:
npx ai-devkit@latest memory search --query "<project> smoke setup" --tags "smoke". Build once, then write the script fromreferences/smoke-template.sh(CLI, API) orreferences/web-smoke-template.mjs(browser). Each check asserts output, files, HTTP status, or exit code, not just "it ran"; API checks also assert the body and one error case (bad input, missing auth). Print PASS/FAIL per check and exit non-zero on any failure. - Run it and read the full output.
- On a failure, first rule out a wrong check (selector, timing, setup), then rerun it on the base commit in a separate worktree (
dev-worktree) to separate regressions from pre-existing failures. - Report with
verify: scenarios, command, exit code, per-check result, pre-existing failures, flows not covered. - Delete the script and sandbox, or offer to promote valuable checks into permanent tests or the project's release smoke suite. Store non-obvious setup:
npx ai-devkit@latest memory store --title "<project> smoke setup" --content "<start command, port, health URL, seeding, traps>" --tags "smoke".
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 43 lines · 73 tokens per session scan A abfa3a1a34f0
dev-smoke is a skill published in the GitHub repository codeaholicguy/ai-devkit (1,653 stars, last pushed 2d ago), licensed Apache-2.0. It adds 73 tokens to every session and 891 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-24.
Other skills, from other repositories
appium-skill
Generates production-grade Appium mobile automation scripts for Android and iOS in Java, Python, or JavaScript. Supports real device and emulator testing locally and on TestMu AI cloud with 100+ real devices.
android-ui-journey-testing
XML-specified Android UI journey testing, interactive step execution, assertion verification, and JSON outcome reporting.
quinn
Verifies specified behavior through appropriate tests and truthful coverage reports.
android_ui_verification
Automated end-to-end UI testing and verification on an Android Emulator using ADB.
browser-testing-with-devtools
Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be…
awt-e2e-testing
AI-powered E2E web testing — eyes and hands for AI coding tools. Declarative YAML scenarios, Playwright execution, visual matching (OpenCV + OCR), platform auto-detection (Flutter/React/Vue), learning DB. Install: npx skills add ksgisang/awt-skill --skill awt -g.