Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kvdm-co-pilot/create-cmp/cmp-previewnpx skills add kvdm-co-pilot/create-cmp --skill cmp-previewgit clone --depth 1 https://github.com/kvdm-co-pilot/create-cmpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-preview)<a href="https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-preview"><img src="https://agentmods.dev/badge/skills/kvdm-co-pilot/create-cmp/cmp-preview.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00268 | $0.02498 |
| Opus 5 | $0.00134 | $0.01249 |
| Sonnet 5 | $0.00054 | $0.00500 |
| Haiku 4.5 | $0.00027 | $0.00250 |
Grade B, and why
cmp-preview scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
1. **Plugin enabled?** Check `enabledPlugins` in `~/.claude/settings.json` (or the project's How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cmp-preview — live previews of real screens, zero commands
Your job: give the human a live gallery URL of their app's real screens and keep it current while they (or you) edit code — and use the structural side of the same render to verify changes. Nobody runs Gradle by hand; the MCP service owns the loop.
Before anything: confirm the capability (fail loud)
The cmp-inspector MCP tools are a capability, not a given. Before your first call, confirm they resolve (ToolSearch for "cmp-inspector"). If no tools match, STOP — do not fall back to manual Gradle, screenshots, or raw adb silently. Diagnose in order and REPORT to the human:
- Plugin enabled? Check
enabledPluginsin~/.claude/settings.json(or the project's.claude/settings.json). - Session older than the plugin's enablement? MCP servers attach at session START — a session born without the plugin never gains its tools, and no amount of in-session retrying will surface them. The fix is restarting the session.
- Plugin copy stale or server broken? Run cmp-doctor's inspector-MCP check group.
Only after reporting may the documented degraded path (./gradlew :composeApp:renderScreens
node qa/preview-gallery.mjs) be used — and the report must name what is lost: on-save re-render, changed-screen attribution, and thepreview_diffchange proof.
The one-call flow
preview { projectDir }(cmp-inspector MCP) — starts (or reuses) the resident service. It:- renders every
inspector/PreviewRegistry.ktentry headlessly via the app's generated:composeApp:renderScreenstask (real Koin DI, real theme, real data); - serves the live gallery at the returned
url(defaulthttp://127.0.0.1:9600/); - watches
composeApp/src/**— every save re-renders (debounced, serialized) and the page reloads itself via SSE, with changed screens flaggedCHANGED. 1b. Phase 2 runs automatically (hot, default true): the service boots a resident preview daemon under Compose Hot Reload (hotRunDesktop --mainClass=<pkg>.inspector.PreviewDaemonKt --auto, JBR auto-provisioned). Saving a file recompiles incrementally and hot-swaps classes INTO the running JVM; renders go through the daemon's loopback/render— measured on a real app: ~900ms for one screen, ~7s for all seven, ~10s save→gallery-shows-the-change (vs 25–40s per change on the task path). If the daemon can't boot (no dev-client feature/hot-reload plugin, no JBR) the service transparently stays on the Gradle path — same gallery, slower loop.
- renders every
- Hand the human the
url(open it for them if you can, e.g.open <url>on macOS, or the host's browser surface). That's their whole workflow: edit → save → watch the gallery update. First render includes a Gradle compile (tens of seconds); warm saves re-render in a few seconds. - You work structurally — after every edit, ONE call:
preview_status { waitForRender: true }. It blocks until the render (or the recompile) finishes and returnschangedLastRender(empty = your edit reached no screen),lastError/lastErrorSource("compile"= your edit didn't even build — the daemon surfaces hot-recompile failures, you are NOT flying blind), andscreens: [{ id, nodes, tokenized, tagged, a11yPass, a11yViolations, lastChangedVersion, tree, png }]. No HTTP polling, no sleeps. Assert deeper on thetreepaths withinspect_tree(passtestTagfor one subtree) — never read PNGs. preview_stop {}when the session is done (the Gradle daemon stays warm — good).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 155 lines · 268 tokens per session scan B 74794e4111ae
cmp-preview is a skill published in the GitHub repository kvdm-co-pilot/create-cmp (0 stars, last pushed 5d ago), licensed MIT. It adds 268 tokens to every session and 2,498 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
compose-multiplatform
Use when building one shared Compose UI in Kotlin across Android, iOS, and desktop — commonMain @Composables, expect/actual, source-set placement, native interop, multiplatform ViewModel/navigation/Koin. NOT a single-platform native build (that is kotlin-android / swift-ios), and NOT Dart/Flutter cross-platform UI…
pdfkmp
Use this skill when the user asks to generate a PDF document from Kotlin (Android, iOS, or Kotlin Multiplatform) using the PdfKmp library. Triggers: 'generate a PDF', 'export to PDF', 'create a PDF report', 'invoice PDF', 'PDF receipt', 'multi-page PDF', any time the user wants to author or modify code that calls into…
m3-expressive
Material 3 Expressive design patterns for Jetpack Compose - expressive theming, motion physics, shape morphing, typography emphasis, color emphasis, and all 28 expressive components.
android-device-integrity
Android app/device integrity and anti-fraud for a fintech app — the Play Integrity API (com.google.android.play:integrity): Standard requests (StandardIntegrityManager.prepareIntegrityToken → StandardIntegrityTokenProvider.request with a requestHash → StandardIntegrityToken) vs Classic requests…
offline-first
Offline-first architecture patterns - NetworkBoundResource, sync strategies, conflict resolution, cache invalidation, and connectivity monitoring.
cloudkit
Implement, review, or debug iCloud sync in iOS/macOS apps with CloudKit. Covers CKContainer + private/public/shared CKDatabase, CKRecord / CKRecord.Reference / CKAsset, CKQuery + CKQueryOperation, CKSubscription (query/database/recordZone) with silent push, CKSyncEngine (iOS 17+: state serialization…