Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/expensify/app/coding-standardsnpx skills add Expensify/App --skill coding-standardsgit clone --depth 1 https://github.com/Expensify/AppWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00033 | $0.01675 |
| Opus 5 | $0.00016 | $0.00838 |
| Sonnet 5 | $0.00007 | $0.00335 |
| Haiku 4.5 | $0.00003 | $0.00168 |
Grade A, and why
coding-standards scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Expensify Coding Standards
Coding standards for the Expensify App. Each standard is a standalone file in rules/ with reasoning, examples, and applicability conditions.
Categories
| Category | Prefix | Focus |
|---|---|---|
| Performance | PERF-* |
Render optimization, memo patterns, useEffect hygiene, data selection |
| Consistency | CONSISTENCY-* |
Platform checks, magic values, unused props, ESLint discipline, localization, file naming, JSDoc |
| Clean React Patterns | CLEAN-REACT-PATTERNS-* |
Composition, component ownership, state structure, prop typing, function components |
| UI | UI-* |
Loading indicators, scrollable pages, styling conventions |
Quick Reference
Performance
- PERF-1 — No spread in renderItem
- PERF-2 — Return early before expensive work
- PERF-3 — Use OnyxListItemProvider in renderItem
- PERF-5 — Shallow over deep comparisons
- PERF-6 — Derive state from props
- PERF-7 — Reset via key prop
- PERF-8 — Handle events in handlers
- PERF-9 — No useEffect chains
- PERF-10 — No useEffect parent communication
- PERF-11 — Optimize data selection
- PERF-12 — Prevent memory leaks
- PERF-13 — Hoist iterator-independent calls
- PERF-14 — Use useSyncExternalStore
- PERF-15 — Clean up async Effects
- PERF-16 — Guard double initialization
- PERF-17 — Pass raw source, index on demand (no pre-built digest)
- PERF-18 — Use usePreMountDestination for RHP pre-mounting
What ships with it
48 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- rules/clean-react-0-compiler.md 4.8 KB
- rules/clean-react-1-composition-over-config.md 23 KB
- rules/clean-react-2-own-behavior.md 4.7 KB
- rules/clean-react-3-context-free-contracts.md 4.9 KB
- rules/clean-react-4-no-side-effect-spaghetti.md 10 KB
- rules/clean-react-5-narrow-state.md 5.0 KB
- rules/clean-react-6-no-componentprops.md 1.4 KB
- rules/clean-react-7-no-inline-prop-types.md 1.6 KB
- rules/clean-react-8-no-class-components.md 1.3 KB
- rules/clean-react-9-no-proptypes.md 1.4 KB
- rules/consistency-1-no-platform-checks.md 1.4 KB
- rules/consistency-10-jsdoc.md 2.0 KB
- rules/consistency-11-no-todo-comments.md 1.3 KB
- rules/consistency-12-callback-named-for-action.md 2.1 KB
- rules/consistency-13-document-props.md 1.8 KB
- rules/consistency-14-new-file-header.md 1.8 KB
- rules/consistency-15-comment-why.md 1.1 KB
- rules/consistency-16-plain-comment-style.md 2.3 KB
- rules/consistency-17-no-ai-jargon.md 1.8 KB
- rules/consistency-18-plural-form.md 7.3 KB
- rules/consistency-2-no-magic-values.md 1.3 KB
- rules/consistency-3-no-code-duplication.md 1.9 KB
- rules/consistency-4-no-unused-props.md 1.6 KB
- rules/consistency-5-justify-eslint-disable.md 2.0 KB
- rules/consistency-6-proper-error-handling.md 1.5 KB
- rules/consistency-7-localize-copy.md 2.0 KB
- rules/consistency-8-localize-numbers-dates.md 2.1 KB
- rules/consistency-9-file-naming.md 2.9 KB
- rules/perf-1-no-spread-in-renderitem.md 1.2 KB
- rules/perf-10-no-useeffect-parent-comm.md 1.6 KB
- rules/perf-11-optimize-data-selection.md 6.5 KB
- rules/perf-12-prevent-memory-leaks.md 1.6 KB
- rules/perf-13-hoist-iterator-calls.md 2.4 KB
- rules/perf-14-use-sync-external-store.md 3.1 KB
- rules/perf-15-cleanup-async-effects.md 2.7 KB
- rules/perf-16-guard-double-init.md 2.7 KB
- rules/perf-17-pass-raw-index-on-demand.md 3.8 KB
- rules/perf-18-use-pre-mount-destination.md 5.0 KB
- rules/perf-2-early-return.md 1.2 KB
- rules/perf-3-onyx-list-item-provider.md 1.0 KB
- rules/perf-5-shallow-comparison.md 1.3 KB
- rules/perf-6-derive-state-from-props.md 1.3 KB
- rules/perf-7-reset-via-key-prop.md 1.5 KB
- rules/perf-8-events-in-handlers.md 1.4 KB
- rules/perf-9-no-useeffect-chains.md 2.4 KB
- rules/ui-1-correct-loading-indicator.md 3.4 KB
- rules/ui-2-new-page-scrollview.md 2.2 KB
- rules/ui-3-no-inline-styles.md 1.5 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 83 lines · 33 tokens per session scan A 579f2466418c
coding-standards is a skill published in the GitHub repository Expensify/App (5,015 stars, last pushed yesterday), licensed MIT. It adds 33 tokens to every session and 1,675 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…