bobbit: Skill for Claude Code

.claude/skills/prw-preview/SKILL.md

prw-preview is a skill for Claude Code from G-Research/bobbit. It costs 25 tokens per session (2,313 once invoked), scanned A, original, MIT.

A preview setup for a PR Walkthrough panel, using the panel’s actual source code and the application’s theme connection. A PR, or pull request, is a proposed code change for review.

In plain words
What is it for?
Use it when iterating on the PR Walkthrough panel’s layout or checking how it renders in the application theme.
Why use it?
It lets developers inspect layout changes in a preview that matches the real panel and theme, reducing differences between the preview and the finished interface.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

This is G-Research/bobbit's own configuration. It tells Claude Code how to work on bobbit itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything bobbit configures →

Needs its repository: it reads a path above its own folder, which exists only inside the repository. The line is import createPanel from "../../../market-packs/pr-walkthrough/src/panel.js";.

Reuse

Borrowing it

Nothing to install: this file belongs to G-Research/bobbit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/G-Research/bobbit/main/.claude/skills/prw-preview/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/G-Research/bobbit

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for prw-preview

README.md
[![agentmods](https://agentmods.dev/badge/skills/g-research/bobbit/prw-preview/github.svg)](https://agentmods.dev/skills/g-research/bobbit/prw-preview)
Your own site
<a href="https://agentmods.dev/skills/g-research/bobbit/prw-preview"><img src="https://agentmods.dev/badge/skills/g-research/bobbit/prw-preview/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for prw-preview

Your own site · 80×15
<a href="https://agentmods.dev/skills/g-research/bobbit/prw-preview"><img src="https://agentmods.dev/badge/skills/g-research/bobbit/prw-preview.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 25 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,313 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 2 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium MCP Rug Pull · line 192
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 204
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00025 $0.02313
Opus 5.5 $0.00010 $0.00925
Sonnet 5.5 $0.00005 $0.00463
Haiku 4.5 $0.00003 $0.00231

Measured 2mo ago against content hash 18433b2e8714, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

prw-preview scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/prw-preview/SKILL.md · 225 lines

How it starts

The opening of the file, as written. The whole thing — 225 lines — stays where its author put it; the contents beside it link to each section on GitHub.

PR Walkthrough Like-for-Like Preview

Create a live preview of the PR Walkthrough panel that is faithful enough for layout iteration.

Non-negotiables

  • Import the exact source: market-packs/pr-walkthrough/src/panel.js.
  • Do not copy panel HTML by hand.
  • Do not define --background, --card, --primary, or any other theme variables in the preview HTML.
  • Use Bobbit preview_open(file=..., assets=["bundle.js"]) so the preview iframe gets the real theme bridge.
  • If taking screenshots, prefer the in-app preview iframe. Standalone file:// or local HTTP screenshots do not prove theme parity.
  • The mock recover route must return found: true and a YAML payload, or the real panel will correctly render the missing state.

Steps

  1. Create a temporary preview directory:
mkdir -p .bobbit/tmp/prw-preview
  1. Write .bobbit/tmp/prw-preview/index.html with no custom palette:
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <title>PR Walkthrough Preview</title>
  <style>
    html, body, #root { height: 100%; margin: 0; }
    body {
      background: var(--background);
      color: var(--foreground);
      overflow: hidden;
    }
  </style>
</head>
<body>
  <div id="root"></div>
  <script type="module" src="./bundle.js"></script>
</body>
</html>
  1. Write .bobbit/tmp/prw-preview/entry.ts that imports the exact source panel:
import { html, nothing, render } from "lit";
import createPanel from "../../../market-packs/pr-walkthrough/src/panel.js";

const panel = createPanel({ html, nothing, renderHeader: () => nothing });
const root = () => document.getElementById("root");
let currentParams: any = {};
let currentHost: any;
let renderQueued = false;
const hostStoreData = new Map<string, unknown>();

const READY_YAML = `schema_version: 1
pr:
  provider: github
  owner: SuuBro
  repo: bobbit
  number: 42
  title: Fix terminal reattach
  url: https://github.com/SuuBro/bobbit/pull/42
  base_sha: 135c5ef1234567890
  head_sha: 6fa7ce0123456789
  original_description:
    body: Preview fixture
    source: gh_api
    fetched_at: "2026-06-28T12:00:00.000Z"
  stats:
    files_changed: 16
    additions: 828
    deletions: 104
walkthrough:
  context:
    why_created: Fix terminal reattach after refresh.
    problem_solved: Reopened sessions reconnect to persisted background processes.
    why_worth_merging: Prevents users losing terminal context.
    merge_concerns: Verify restart recovery manually.
    author_intent: Reuse saved process metadata to restore terminal streams.
    reviewer_map: core: src/server/agent/bg-process-manager.ts — reattach lifecycle
  merge_assessment:
    recommendation: comment
    confidence: medium
    summary: Core reattach path is covered; manually verify restart recovery.
    blocking_concerns: []
    non_blocking_concerns: []
  design_decisions: []
  review_chunks: []
  omissions_and_followups: []
  audit:
    remaining_changed_areas: []
    low_signal_or_mechanical_changes: []
    generated_or_binary_files: []
    reviewer_checklist:
      - Browser coverage for terminal refresh and session navigation reattach.
  display:
    phase_order: [orientation, significant, audit]
    chunk_order: []
`;

const READY_BUNDLE = {
  found: true,
  persistedAt: "2026-06-28T12:00:00.000Z",
  changeset: {
    provider: "github",
    owner: "SuuBro",
    repo: "bobbit",
    number: 42,
    url: "https://github.com/SuuBro/bobbit/pull/42",
    prTitle: "Fix terminal reattach",
    title: "Fix terminal reattach",
    baseSha: "135c5ef1234567890",
    headSha: "6fa7ce0123456789",
    filesChanged: 16,
    additions: 828,
    deletions: 104,
  },
  cards: [
    {
      id: "orientation-overview",
      phaseId: "orientation",
      navLabel: "Orientation",
      title: "PR context",
      summary: "Terminal reattach now restores persisted background processes after refresh or restart.",
      rationale: "Focused six-beat reviewer orientation.",
      sections: [
        { id: "what-changed-and-why", navLabel: "What/why", eyebrow: "Purpose", heading: "What changed and why", body: "Fixes terminal reattach so reopened sessions reconnect to persisted background processes instead of showing stale or disconnected terminal state.", showStats: true },
        { id: "how-it-works", navLabel: "How it works", eyebrow: "Implementation", heading: "How it works", body: "The runtime resolves saved process metadata, reconnects the terminal stream when the process is still alive, and surfaces clear stopped/stale states when reattach is not possible." },
        { id: "change-map", navLabel: "Change map", eyebrow: "Review map", heading: "Change map", fileRoles: [{ role: "core", file: "src/server/agent/bg-process-manager.ts", note: "reattach lifecycle" }] },
        { id: "risks-and-edge-cases", navLabel: "Risks", eyebrow: "Risk", heading: "Risks and edge cases", concerns: [{ severity: "blocking", text: "A dead process must not be shown as reattached or interactive." }] },
        { id: "validation", navLabel: "Validation", eyebrow: "Evidence", heading: "Validation", items: ["Browser coverage for terminal refresh and session navigation reattach."] },
        { id: "merge-recommendation", navLabel: "Merge", eyebrow: "Decision", heading: "Merge recommendation", body: "Merge if reattach works after refresh and stale process states stay explicit.", verdict: { recommendation: "comment", confidence: "medium", summary: "Verify restart recovery manually before approval." } },
      ],
      checklist: [],
      diffBlocks: [],
      suggestedComments: [],
    },
    { id: "runtime", phaseId: "significant", navLabel: "Runtime", title: "Terminal reattach runtime", summary: "Reconnects reopened sessions to existing background process streams when possible.", rationale: "Primary behavior change.", checklist: [], diffBlocks: [], suggestedComments: [] },
    { id: "audit", phaseId: "audit", navLabel: "Audit", title: "Final review controls", summary: "Confirm completion and export controls.", rationale: "Submit flow smoke card.", checklist: [], diffBlocks: [], suggestedComments: [] },
  ],
  warnings: [],
  export: { available: false, reason: "Preview fixture" },
};

function scheduleRender() {
  if (renderQueued) return;
  renderQueued = true;
  queueMicrotask(() => {
    renderQueued = false;
    if (currentHost) renderPanel(currentParams, currentHost);
  });
}

const host = {
  store: {
    async get(key: string) { return hostStoreData.get(key); },
    async put(key: string, value: unknown) { hostStoreData.set(key, value); },
  },
  async callRoute(route: string) {
    if (route === "recover") return { found: true, finalized: true, jobId: "preview-job", yaml: READY_YAML, baseSha: "135c5ef1234567890", headSha: "6fa7ce0123456789", finalizedAt: Date.now() };
    if (route === "bundle") return READY_BUNDLE;
    if (route === "status") return { phase: "submitted", finalized: true, jobId: "preview-job", yaml: READY_YAML };
    return undefined;
  },
  requestRender: scheduleRender,
};

function renderPanel(params: any, hostArg: any) {
  currentParams = params;
  currentHost = hostArg;
  render(panel.render(currentParams, currentHost), root()!);
}

renderPanel({ __sessionId: "preview-child", jobId: "preview-job" }, host);

Read the full file on GitHub · 225 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 225 lines · 25 tokens per session scan A 18433b2e8714

Subscribe to this mod's changes

prw-preview is a skill published in the GitHub repository G-Research/bobbit (18 stars, last pushed 1mo ago), licensed MIT. It adds 25 tokens to every session and 2,313 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

prw-preview compared with skills from other repositories

prw-preview next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
prw-previewG-Research/bobbitSkill181mo agoMITA25Claude Code
autoreviewopenclaw/clawhubSkill9.5kyesterdayMITA17Claude Code, Codex
agent-teams-simplify-and-hardenLeoYeAI/openclaw-master-skillsSkill2.2k6d agoMITA115Claude Code, Codex
omh-code-reviewrlaope/oh-my-hermesSkill5.2kyesterdayMITA48Claude Code, Codex
revdiff-planumputun/revdiffSkill945yesterdayMITA84Claude Code
explore-unknownsdzhng/skillsSkill1.4k2d agoMITA162Claude Code, Codex
re0-mergeLilMGenius/paperthinSkill1.4k4d agoMITA70Claude Code