anarlog is a local-first AI meeting notetaker that captures device audio, transcribes meetings, and stores notes, transcripts, and recordings on the user's computer. It is for people who want meeting notes without adding a bot to calls or sending conversation data to an external cloud. The catalogue entries provide agent integrations and workflows for the application.
Borrowing it
Nothing to install: this file belongs to fastrepl/anarlog. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/fastrepl/anarlog/main/.agents/skills/qa-critical-ux/SKILL.mdgit clone --depth 1 https://github.com/fastrepl/anarlogWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fastrepl/anarlog/qa-critical-ux)<a href="https://agentmods.dev/skills/fastrepl/anarlog/qa-critical-ux"><img src="https://agentmods.dev/badge/skills/fastrepl/anarlog/qa-critical-ux/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fastrepl/anarlog/qa-critical-ux"><img src="https://agentmods.dev/badge/skills/fastrepl/anarlog/qa-critical-ux.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 86 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 87 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 86 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 87 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 86 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 87 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.01302 |
| Opus 5.5 | $0.00016 | $0.00521 |
| Sonnet 5.5 | $0.00008 | $0.00260 |
| Haiku 4.5 | $0.00004 | $0.00130 |
Grade C, and why
qa-critical-ux scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf ~/Library/Application\ Support/com.hyprnote.staging How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA: Critical User Experience
Run this workflow only when the user explicitly asks for QA. A release request alone does not invoke it, and QA results do not approve or block a release.
Test only the signed staging artifact for the requested candidate:
- The app launches and never hangs.
- Onboarding completes from scratch: permissions, sign-in, and provider setup.
- A recording captures both microphone and system audio.
- Stopping the recording produces an automated summary.
- The note syncs to the account and comes back after a local wipe.
Everything else is outside this skill's scope.
Out of Scope
Record incidental failures against the existing Linear ticket without expanding this run:
- AEC quality:
ANLG-98 - Automatic speaker identification:
ANLG-222 - Real-world capture across devices, rooms, and participants:
ANLG-284 - Auth callback and sign-out edge cases:
ANLG-285 - Calendar, events, and notifications:
ANLG-286 - CloudSync activity deferral and transcript integrity:
ANLG-287 - On-device STT/LLM provider matrix:
ANLG-288
Build the Staging Candidate
Trigger desktop_cd.yaml with channel=staging from the requested candidate SHA. Verify the run's head SHA, download that run's artifact by ID, and never use a latest-staging download:
gh workflow run desktop_cd.yaml \
--ref <candidate-ref> \
-f channel=staging \
-f candidate_sha=<40-character-candidate-sha>
gh run view <run-id> --json headSha,url
gh run download <run-id> --name hyprnote-staging-macos-silicon
Record the run URL and DMG SHA-256, install the artifact, and verify the app reports the expected version. The staging artifact must be signed output from that exact workflow run; do not substitute a local build.
Leave the MacBook open on its built-in speakers and microphone with no external audio device attached.
Start from Onboarding
-
Fully quit Anarlog Staging.
-
Reset staging permissions while the app is closed:
.agents/skills/qa-critical-ux/scripts/reset-native-qa-permissions.sh
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -67 lines · +5 tokens per session 31667f3729b1
- 2mo ago First seen · 200 lines · 34 tokens per session scan C 9c5e3db040ad
qa-critical-ux is a skill published in the GitHub repository fastrepl/anarlog (9,621 stars, last pushed yesterday), licensed MIT. It adds 39 tokens to every session and 1,302 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
frontend-standards
React renderer standards — ports & adapters (service hooks), design tokens, motion tokens, @ajh/ui primitives, i18n, feature isolation, React Query, a11y. Load for changes under apps/desktop/src/renderer/.
testing-rules
Testing standards — frameworks, the testable-logic trigger, golden/snapshot rules, mocking rules, and the test-author → testing-reviewer pipeline. Load for /add-tests and any change that touches testable logic.
author-contract
Shared write-side contract every domain AUTHOR imports — smallest-diff implementation, ground-first, validation gates, tests-are-blocking, and never-approve-your-own-work. The write-side mirror of token-efficiency. Load at the start of any implementation task.
coding-standards
General repo rules enforced by ESLint/TypeScript/CI — PRs-only, never bypass lint, import ordering, type imports, path privacy, commit format. Load for any code change.
kortix-ui
Build React UI with @kortix/ui, the Kortix component library and the whole Kortix session experience as modules (session workspace, thread, composer, side panel, files, file viewer, terminal, project sidebar and home, customize pages): Kortix Apps, white-label hosts, custom dashboards on @kortix/sdk and apps/web. Load…
audit-accessibility
Unified accessibility auditing workflow across static analysis, runtime testing, ARIA patterns, keyboard navigation, and color contrast. Use this skill whenever the user mentions accessibility, a11y, WCAG, ARIA roles, axe tests, screen readers, focus management, keyboard navigation, color contrast, or wants to audit…