lpm: Skill for Claude Code

.claude/skills/app-review-video/SKILL.md

app-review-video is a skill for Claude Code from gug007/lpm. It costs 153 tokens per session (2,475 once invoked), scanned A, original, MIT.

A workflow for recording a review video that shows a Mac app and the same app on a physical iPhone. It prepares isolated demo projects, places the two windows side by side, and records only that area for App Store review.

In plain words
What is it for?
Use it to build the review setup, pair and control the iPhone, demonstrate the app, and capture the required review video.
Why use it?
It creates a repeatable demonstration without showing personal data, unrelated windows, notifications, or the developer's own environment. The recorded actions are real interactions with the Mac and phone.

Skill for Claude Code

Written for Claude Code: argument-hint in frontmatter.

This is gug007/lpm's own configuration. It tells Claude Code how to work on lpm itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything lpm configures →

Not installable: its command points at a path on the author’s own machine, so it runs nowhere else. The line is /Users/Shared/lpm-review.

Reuse

Borrowing it

Nothing to install: this file belongs to gug007/lpm. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/gug007/lpm/main/.claude/skills/app-review-video/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/gug007/lpm

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for app-review-video

README.md
[![agentmods](https://agentmods.dev/badge/skills/gug007/lpm/app-review-video/github.svg)](https://agentmods.dev/skills/gug007/lpm/app-review-video)
Your own site
<a href="https://agentmods.dev/skills/gug007/lpm/app-review-video"><img src="https://agentmods.dev/badge/skills/gug007/lpm/app-review-video/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for app-review-video

Your own site · 80×15
<a href="https://agentmods.dev/skills/gug007/lpm/app-review-video"><img src="https://agentmods.dev/badge/skills/gug007/lpm/app-review-video.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 153 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,475 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00153 $0.02475
Opus 5.5 $0.00061 $0.00990
Sonnet 5.5 $0.00031 $0.00495
Haiku 4.5 $0.00015 $0.00248

Measured 6d ago against content hash f682938efed2, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

app-review-video scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

The scan reads SKILL.md. This mod also ships 9 executable files (scripts/activity.js, scripts/camera.js, scripts/cards.js, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/app-review-video/SKILL.md · 114 lines

How it starts

The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.

App Review asks for a video of lpm Link on a physical device connected to the Mac (the earlier one: unlisted YouTube, linked from App Review Information → Notes). This skill makes it: the left half is the lpm desktop app, the right half is the real iPhone through iPhone Mirroring, and every tap and click is a real one made with computer use.

scripts/review.js runs the session (node scripts/review.js prints the commands):

  • setup builds (first run, or --build after desktop changes) an isolated debug app named lpm Review (bundle cx.lpm.appreview, so computer use can see it and never touches the user's own lpm), wipes and seeds ~/.lpm-review with three demo projects under /Users/Shared/lpm-review (storefront with api :4000 and web :5173, payments-api, docs-site), turns remote control on (port 8792), names the Mac MacBook Pro (--name; no owner name, no dev marker), neutral shell prompt, and places its window to the left of the iPhone Mirroring window, as tall as the phone.
  • record starts a ScreenCaptureKit recording of the rectangle around both windows, with every other app left out (notifications, the user's windows and dialogs never show) and the pointer drawn. It also logs every mouse press, release and move and the moment of each key press (never which key) to events.jsonl, through a listen-only event tap. It returns at once; the capture keeps running.
  • mark "<caption>" "<subtitle>" starts the next numbered step caption.
  • checkpoint before an uncertain action; cut if it went wrong drops everything since the checkpoint from the video. Redo the action after the cut.
  • stop, then render --device "<model>" [--build <n>] [--version <v>] [--cut a-b,…] [--redact <regex>] [--no-camera] writes ~/Movies/lpm-app-review/<stamp>/lpm-link-<version>-app-review.mp4 and steps.txt (where each step starts). The version defaults to mobile/ios/project.yml. The render:
    • keeps each click's response (the screen changes until the next click, at most 12 s) with a short hold, and drops everything between: waits, a server's log, a clock (edit.js);
    • draws a ripple at every click;
    • eases in up to 1.8x on the part of the phone a tap changed (a menu, the message field) when the response stays on the phone, and back out when it reaches the Mac or the next click is on the Mac; the header then names only the device in view (camera.js);
    • reads the kept frames twice a second with Vision and blurs any line in someone's possessive form ("Someone's MacBook Pro"), any email address and any --redact pattern, for as long as it is on screen; the review Mac's own name stays readable (redact.js);
    • with no events.jsonl (an older take) it cuts on screen changes alone.
  • teardown quits the review Mac (the phone hears it close), stops its servers and deletes its data and demo projects.

Before the take

  1. The iPhone has the build under review installed (Xcode or TestFlight) and is near the Mac, locked, on the Mac's Wi-Fi. Ask the user for the device model and build number for the title card if they matter.
  2. request_access(["iPhone Mirroring"]), open_application("iPhone Mirroring"), screenshot. "iPhone in Use" means the user has the phone: ask them to lock it. Bring lpm Link to its first screen ("Connect to your Mac"): ⌘2 (App Switcher), swipe its card up, ⌘3 (Spotlight), type lpm Link, open the top hit. If it lists saved Macs instead, ask the user before removing any.
  3. node scripts/review.js setup, then request_access(["cx.lpm.appreview"]) and a screenshot: lpm Review on the left with the three projects, the phone on the right.

The take (record, then for each step mark first, then act). Call open_application for the app you are about to click before every batch: a screenshot hands focus to another granted app, and the click then lands in the wrong one.

# mark actions must be on screen
1 Pair lpm Link with the Mac / Same Wi-Fi: pick the Mac on the iPhone, then approve it on the Mac Mac: sidebar More → Mobile app (Mobile devices: Remote control On, Same network Ready). Phone: Pair for this Wi-Fi only → the row named MacBook Pro with "Tap, then approve on the Mac". Mac: "Allow this device to connect?" with a match code; rest the pointer on the Mac's code, then the phone's, then Allow phone "Connected to MacBook Pro"; Mac "iPhone · Connected now"
2 The Mac's projects appear on the iPhone / The same list as the Mac's sidebar phone Done; point at the Mac sidebar, then the phone list; Mac: click storefront the same three projects on both
3 Start a project from the iPhone / Its dev servers start on the Mac phone: storefront → ··· → Start; Mac: click the All tab; phone: tap api (its output sheet), wait for the output Mac Stop button + both servers listening; phone "Running" and the same output
4 Stop it from the iPhone / The Mac stops the dev servers phone: Close, ··· → Stop Mac back to Start; phone "Stopped"
5 Open a terminal on the Mac from the iPhone / Type on the iPhone; the command runs on the Mac phone + (opens Terminal 1 on the Mac) → tap Terminal 1 → tap Message, type git status && ls src, send (↑) Mac "Active in iPhone · Take control"; the output on the phone
6 Take the terminal back on the Mac / The same session, with what the iPhone ran Mac: Take control the command and its output in the Mac terminal; phone "Active on Main window"

Read the full file on GitHub · 114 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago Changed f682938efed2
  2. 15d ago First seen · 114 lines · 153 tokens per session scan A 6606b4cca27e

Subscribe to this mod's changes

app-review-video is a skill published in the GitHub repository gug007/lpm (145 stars, last pushed today), licensed MIT. It adds 153 tokens to every session and 2,475 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-09.