Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kvdm-co-pilot/create-cmp --skill cmp-doctorgit clone --depth 1 https://github.com/kvdm-co-pilot/create-cmpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-doctor)<a href="https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-doctor"><img src="https://agentmods.dev/badge/skills/kvdm-co-pilot/create-cmp/cmp-doctor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00287 | $0.02159 |
| Opus 5 | $0.00143 | $0.01079 |
| Sonnet 5 | $0.00057 | $0.00432 |
| Haiku 4.5 | $0.00029 | $0.00216 |
Grade D, and why
cmp-doctor scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
(The stamped E2E harness is Maestro — `curl -fsSL https://get.maestro.mobile.dev | bash`; the Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
a local path (find it in `~/.claude/plugins/known_marketplaces.json` or settings Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
(The stamped E2E harness is Maestro — `curl -fsSL https://get.maestro.mobile.dev | bash`; the How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cmp-doctor — bootstrap the CMP toolchain & diagnose the project
Your job: get the machine to a state where a CMP/KMP project can build (Android, and iOS on macOS)
and run device tests — and, when run inside a project, get the project to a buildable state too.
(The stamped E2E harness is Maestro — curl -fsSL https://get.maestro.mobile.dev | bash; the
Appium drivers below serve the legacy pre-Maestro path.)
You wrap the engine's bootstrap (src/doctor.mjs per CONTRACT/DESIGN; exposed on the CLI as the
doctor subcommand). Do not hand-roll installs in bash when the engine can do
it — the engine is idempotent and verifies each tool. Use this skill to drive it and to relay its
consent prompts.
What it checks, then offers to install
- JDK 17 (Temurin, via Homebrew or SDKMAN).
- Android SDK + cmdline-tools via
sdkmanager(platform, build-tools, platform-tools, emulator, a system image) and a bootable AVD. - Xcode + Command Line Tools — checks
xcode-select. Xcode itself cannot be installed from the CLI; the App Store step is surfaced as the one unavoidable manual action and handled gracefully. - CocoaPods and XcodeGen (Homebrew).
- Node + Appium 3.x and its drivers (
appium driver install uiautomator2, andxcuiteston macOS), each verified — legacy e2e path only; Maestro is a separate one-line install. - adb / emulator reverse-port wiring for the test harness.
On Linux, it scopes to Android-only and says so explicitly (no iOS toolchain).
Project diagnosis — works on ANY KMP project
When doctor runs inside (or is pointed at, via --target-dir) a directory with Gradle files, it
adds a project diagnosis section on top of the toolchain checks. This works on any KMP project
with a gradle/libs.versions.toml — whoever scaffolded it:
- kotlin ↔ ksp lockstep —
kspmust be<kotlin>-<kspVersion>; a mismatch is the classic KMP build-killer and is reported as a FAIL. - Drift vs the nearest proven-green version set — which catalog versions differ from a
CI-verified set, with
create-cmp upgradeas the one-command fix. - The KSP2/iOS catch-22 — Room + an iOS target without
ksp.useKSP2=truein gradle.properties dies at link time withClassNotFoundException: …MainKt; doctor flags it (and--fixheals it). - local.properties / sdk.dir — missing file, missing key, or a path that doesn't exist.
- Environment —
~/.konansize (reported when over 10 GB) and free disk space (warned under 3 GB — a real KMP build-killer).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 137 lines · 287 tokens per session scan D 0a6c33f76da5
cmp-doctor is a skill published in the GitHub repository kvdm-co-pilot/create-cmp (0 stars, last pushed yesterday), licensed MIT. It adds 287 tokens to every session and 2,159 once invoked, about $0.0014 per session on Opus 5. A static security scan graded it D with 3 findings (downloads and executes remote code, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
compose-multiplatform
Use when building one shared Compose UI in Kotlin across Android, iOS, and desktop — commonMain @Composables, expect/actual, source-set placement, native interop, multiplatform ViewModel/navigation/Koin. NOT a single-platform native build (that is kotlin-android / swift-ios), and NOT Dart/Flutter cross-platform UI…
mapkit
MapKit + CoreLocation for iOS (iOS 17–26 era). SwiftUI Map with MapContentBuilder (Marker / Annotation / MapPolyline / MapPolygon / MapCircle / UserAnnotation), MapCameraPosition & MapCamera with onMapCameraChange, mapStyle / mapControls / selection, MapReader + MapProxy coordinate conversion, and Look Around…
navigation
Navigation for Android and Kotlin Multiplatform/iOS apps - all three approaches in one place. (A) Jetpack Navigation Compose (androidx.navigation - NavController, NavHost, composable , type-safe @Serializable routes, nested graphs, bottom nav, deep links, results via SavedStateHandle). (B) Jetpack Navigation 3 / Nav3…
kmp-networking
Ktor HTTP client for Kotlin Multiplatform - shared API layer in commonMain with per-target engines (OkHttp/Android engine on Android, Darwin on iOS), kotlinx.serialization, and shared error handling. Use for multiplatform or shared networking. For an Android-only Ktor/OkHttp client use ktor-patterns. For deeper…
kmp-repositories
Repository pattern for Kotlin Multiplatform. Shared interfaces with platform-specific implementations, clean data layer architecture.
shared-coroutines
Coroutines and Flow in Kotlin Multiplatform shared code - expect/actual dispatchers, iOS main-thread/Darwin constraints, a CoroutineScope shared from commonMain, and exposing StateFlow/Flow to Swift (KMP-NativeCoroutines/SKIE). Use for commonMain/iosMain concurrency. For general, non-multiplatform coroutine and Flow…