CC Pocket is a mobile and desktop client for controlling Codex and Claude coding-agent sessions through a self-hosted Bridge Server running on another computer. It lets users start sessions, approve actions, answer questions, review changes, and continue coding from supported devices. The catalogue entries provide the skills, hooks, MCP servers, agents, instructions, and settings used by this client.
Borrowing it
Nothing to install: this file belongs to K9i-0/ccpocket. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/K9i-0/ccpocket/main/.claude/skills/test-bridge/SKILL.mdgit clone --depth 1 https://github.com/K9i-0/ccpocketWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/k9i-0/ccpocket/test-bridge)<a href="https://agentmods.dev/skills/k9i-0/ccpocket/test-bridge"><img src="https://agentmods.dev/badge/skills/k9i-0/ccpocket/test-bridge/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/k9i-0/ccpocket/test-bridge"><img src="https://agentmods.dev/badge/skills/k9i-0/ccpocket/test-bridge.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 22 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 27 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 33 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 89 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Excessive Agency · line 82 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.00831 |
| Opus 5.5 | $0.00010 | $0.00332 |
| Sonnet 5.5 | $0.00005 | $0.00166 |
| Haiku 4.5 | $0.00003 | $0.00083 |
Grade A, and why
test-bridge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Bridge Server テスト
実行手順
変更した挙動に対応するテストと静的検証を選ぶ。全体テストは、共通基盤・依存関係への変更や回帰懸念がある場合、または全体検証を依頼された場合に実行する。成功済みの検証を理由なく繰り返さない。以下はコマンドの選択肢。
1. ユニットテスト
npm run test:bridge
特定ファイルのみ:
cd packages/bridge && npx vitest run src/<filename>.test.ts
ウォッチモード (開発中):
cd packages/bridge && npx vitest src/<filename>.test.ts
2. TypeScript 型チェック
npx tsc --noEmit -p packages/bridge/tsconfig.json
テストファイル (*.test.ts) と vitest.config.ts は tsconfig.json の exclude に入っているため、型チェック対象外。
3. カバレッジ (任意)
npm run test:bridge:coverage
テスト記述規約
ファイル配置・命名
- テストファイルはソースと同じディレクトリに
<module>.test.tsとして配置- 例:
src/parser.ts→src/parser.test.ts
- 例:
- vitest.config.ts の include パターン:
src/**/*.test.ts
import
import { describe, it, expect } from "vitest";
- vitest からのみ import する (jest の互換 API は使わない)
- テスト対象モジュールは
.js拡張子で import する (NodeNext moduleResolution)- 例:
import { parseRule } from "./claude-process.js";
- 例:
テスト構造
describe("関数名 or クラス名", () => {
it("動作の説明 (英語)", () => {
expect(actual).toBe(expected);
});
});
describeでテスト対象の関数/クラス単位にグルーピングitの説明は英語で、三人称現在形 ("returns null for empty string")- 1つの
itで1つの振る舞いを検証する
テスト対象の方針
- 純粋関数・ロジック中心にテストする (高ROI)
- プロセスspawn, ファイルシステム, WebSocket等の外部依存は対象外
- 現在テスト対象のモジュール:
parser.ts— parseClaudeEvent, claudeEventToServerMessage, parseClientMessage, normalizeToolResultContentclaude-process.ts— parseRule, matchesSessionRule, buildSessionRule, toolNeedsApproval, ACCEPT_EDITS_AUTO_APPROVEimage-store.ts— ImageStore.extractImagePaths
新しいテスト追加時
- export されている純粋関数があればテスト追加を検討
- internal関数をテストしたい場合は
exportに変更する (テスト可能性のための export は OK) - テスト追加後は型チェックが通ること (
npx tsc --noEmit) も確認
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -1 lines ed2e09842b0e
- 1mo ago Changed 1d4c050cf14c
- 1mo ago First seen · 90 lines · 25 tokens per session scan A 2bce004377a7
test-bridge is a skill published in the GitHub repository K9i-0/ccpocket (1,092 stars, last pushed yesterday), licensed MIT. It adds 25 tokens to every session and 831 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
migrate-to-shoehorn
Migrate test files from as type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace as in tests, or needs partial test data.
jest-patterns
Jest and Vitest testing patterns including describe/it blocks, expect matchers, mocking, and async test strategies for JavaScript and TypeScript.
migrate-to-shoehorn
Migrate test files from as type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace as in tests, or needs partial test data.
typescript
TypeScript strict mode with eslint and jest.
flutter
Use when building, structuring, testing or optimizing a Flutter app — feature-first layering, Riverpod 3 or Bloc, typed gorouter, freezed models, a dio data layer, Material 3, jank hunting, widget/golden tests. Targets Flutter 3.44 / Dart 3.12. NOT React Native (that is react-native), NOT Compose Multiplatform (that…
jest-unit
Unit testing skill using Jest for TypeScript and JavaScript, covering mocking, spies, snapshots, coverage, async testing, and custom matchers.