Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kouroshez/coding-os --skill mobile-fundamentalsgit clone --depth 1 https://github.com/kouroshez/coding-osWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kouroshez/coding-os/mobile-fundamentals)<a href="https://agentmods.dev/skills/kouroshez/coding-os/mobile-fundamentals"><img src="https://agentmods.dev/badge/skills/kouroshez/coding-os/mobile-fundamentals.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 289 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 293 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 289 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Rogue Agent · line 371 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00104 | $0.03881 |
| Opus 5 | $0.00052 | $0.01940 |
| Sonnet 5 | $0.00021 | $0.00776 |
| Haiku 4.5 | $0.00010 | $0.00388 |
Grade A, and why
mobile-fundamentals scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 407 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mobile Fundamentals — Cross-Platform Concerns
The mobile-specific concerns that any framework (React Native, Flutter, native iOS/Android) has to address. Stack-agnostic patterns; concrete recipes target the project's React Native client.
When to Use This Skill
- Adding navigation (stack / tab / drawer / modal) to a screen.
- Setting up deep links / universal links / app links.
- Implementing offline-first behavior (queue mutations, sync on reconnect).
- Adding push notifications (FCM + APNs).
- Wiring background tasks (sync, geofence, scheduled refresh).
- Gating sensitive ops with biometrics (Face ID / Touch ID / fingerprint).
- Handling app-state transitions (foreground / background / inactive).
- Planning OTA (over-the-air) updates and the rules around them.
- Preparing for App Store / Play Store review.
For RN-specific code patterns (component shapes, performance, native modules), see react-native-patterns.
The Mobile Constraints That Don't Exist on Web
- Network is unreliable. Cell signal drops; user goes through tunnels; offline is the steady state for some users.
- App can be killed at any moment. iOS aggressively suspends; Android kills background processes.
- Multiple lifecycle states beyond foreground/background — inactive, locked, swiped-away, terminated.
- Storage is shared with the OS — running out of disk wedges your app.
- Battery is precious — anything you do in background is metered.
- App store review is a real release gate, not a CI step.
- Update install rate is slow — 30 days to reach 90% adoption is normal.
Designing for these is the difference between "works in dev" and "actually ships".
Navigation Patterns
Picking the Right Container
| Pattern | Use when | Avoid when |
|---|---|---|
| Stack | Linear flows (sign-in → onboarding → home) | UI has 3+ peer destinations |
| Tab | 2–5 top-level destinations, accessible at all times | Flow has clear forward/back direction |
| Drawer | 6+ destinations, secondary navigation | <5 items (use tabs) |
| Modal | Self-contained task that closes back to where you were | Multi-step with deep nav |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 407 lines · 104 tokens per session scan A 9a532dc65f85
mobile-fundamentals is a skill published in the GitHub repository kouroshez/coding-os (6 stars, last pushed yesterday), licensed Apache-2.0. It adds 104 tokens to every session and 3,881 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
graph-mutation-plan
Cookbook for composing an applygraphmutations plan — stable entitykey patterns, the canonical label/edge vocabulary, evidence/invalidation/confidence discipline, and a worked example. Load this when building a non-trivial mutation plan.
potpie-cli
Use when the task is centered on running, explaining, configuring, or troubleshooting the potpie command: doctor, login, pot management, source registration, search, graph workbench reads/writes, and pot scope behavior.
potpie-change-timeline
Use when an agent needs recent or historical change context: what changed recently, regressions, merged PRs, tickets, docs, incidents, deployments, releases, and source-history ingestion.
potpie-infra-architecture
Use for project infra and architecture context: environments, adapters, runtime configuration, deployments, service dependencies, datastores, API contracts, ownership, incidents, and dependency blast radius.
potpie-project-preferences
Use before writing, modifying, reviewing, refactoring, or testing code so repo/project preferences surface: error handling, file structure, frameworks, logging, dependency choices, testing, security, API style, and naming. Also use after code work when a reusable project preference should be recorded.
phone-harness
Control the user's phone — iPhone through the Mac's iPhone Mirroring window, or an Android over adb: open apps, tap, type, swipe, read the screen.