Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add heristop/leclap --skill pr-evidencegit clone --depth 1 https://github.com/heristop/leclapWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/heristop/leclap/pr-evidence)<a href="https://agentmods.dev/skills/heristop/leclap/pr-evidence"><img src="https://agentmods.dev/badge/skills/heristop/leclap/pr-evidence/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/heristop/leclap/pr-evidence"><img src="https://agentmods.dev/badge/skills/heristop/leclap/pr-evidence.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.03342 |
| Opus 5.5 | $0.00028 | $0.01337 |
| Sonnet 5.5 | $0.00014 | $0.00668 |
| Haiku 4.5 | $0.00007 | $0.00334 |
Grade A, and why
pr-evidence scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PR evidence for app changes
The rule
A pull request that touches apps/leclap-web/** or apps/leclap-expo/** ships with two kinds of evidence in its description:
- Snapshots: before/after stills of every screen the change affects.
- A video made by LeClap: a short before/after evidence clip, rendered by this repo's own engine. It is not a raw screen recording, and it is never a GIF.
Check the trigger against the base branch, not your memory of the diff:
git diff --name-only origin/main...HEAD | grep -E '^apps/leclap-(web|expo)/' && echo "evidence required"
The only exemption is a change with no visible effect, such as tests, types, lint or build config. Even then the description says so in one line (No visible change: <why>), so a reviewer knows the evidence was skipped on purpose rather than forgotten.
1. Decide what to prove
- Before is the branch's base,
git merge-base origin/main HEAD, not the tip oforigin/main, which may carry unrelated changes; after is the branch. Show the same screen, state, data and viewport on both sides, or the comparison proves nothing. - Pick the moment that shows the change: the broken state, the fixed state, the new control in use. Avoid navigation or loading screens.
- Use real content, not lorem ipsum or empty states, unless the empty state is the change.
2. Capture
Work from two worktrees, one on the merge base and one on the branch, so both sides run the real code. A fresh worktree needs the engine dist and the staged assets before the apps run; see the monorepo-dev-workflow skill.
Web (apps/leclap-web)
- Run your own Vite dev server on a free port in each worktree. Never stop, restart or
pkillthe user's servers or anypnpm dev/viteyou didn't start: it kills their live preview. - Drive the pages with a standalone Playwright script, not the Playwright MCP, which throttles to about 2 fps and can return stale frames. Models to copy:
.github/pr-media/{typed-fields,open-in-builder,webmcp}/record.mjsandcamera-warmup/capture.mjs. Theirmake-media.shsiblings also write an animated WebP (-loop 0): don't copy that step, the video replaces it. - Viewports: 1440×900 and 390×844, at device scale factor 2.
- Themes: light and dark where the surface supports both. The studio is dark-only (
StudioSurface.tsx), so shoot it once. - Record the flow with
recordVideo: { dir, size: { width: 1024, height: 768 } }on the browser context. That gives the capture the video is built from: a 1024×768 capture fills each 4:3 pane exactly, any other shape is letterboxed, and Playwright's default 800×800 gets upscaled.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 127 lines · 71 tokens per session scan A 25ba3f917b91
pr-evidence is a skill published in the GitHub repository heristop/leclap (34 stars, last pushed yesterday), licensed MIT. It adds 71 tokens to every session and 3,342 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-13.
Other skills, from other repositories
qiaomu-cut
A workflow for turning a brief video idea into a planned, sourced, edited, rendered, and checked video project.
spec-harness-generate-agents
Bind the 6 SDD agents to THIS project's rules — fill each agent's GEN:rules region with its concern's real rules (implementer←Coding, tester←Testing+commands, reviewer←Reviewing, researcher/planner←Architecture, verifier←goal). Use when Malik says 'generate the agents', 'make the agents project-specific', 'bind agents…
spec-harness-build
Run the SDD pipeline over tasks.md: implement → test → VERIFY → review, one task at a time, under the ratchet. Use when Malik says 'build it', 'run the pipeline', 'implement the tasks', or 'ship this feature'. Each task gated by the separate verifier; lessons harvested by learn.
triage-contributor-pr
Triage open pull requests from external contributors to prisma/orm and produce a per-PR verdict with evidence. Use when a maintainer asks to triage, evaluate, assess, or review the queue of incoming contributor PRs, to decide whether a fork PR is safe to run CI on, to check whether a PR is in scope for its version…
review-implement-phase
Implements triaged review actions, commits focused fixes, and posts Done plus resolves threads. Use when the user wants only the implementation phase of the review-framework workflow.
review-triage-phase
Produces canonical review actions from fetched review state and renders action markdown. Use when the user wants only triage/action-planning for the review-framework workflow.