Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kvdm-co-pilot/create-cmp/cmp-qa-prepnpx skills add kvdm-co-pilot/create-cmp --skill cmp-qa-prepgit clone --depth 1 https://github.com/kvdm-co-pilot/create-cmpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-qa-prep)<a href="https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-qa-prep"><img src="https://agentmods.dev/badge/skills/kvdm-co-pilot/create-cmp/cmp-qa-prep.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00182 | $0.00892 |
| Opus 5 | $0.00091 | $0.00446 |
| Sonnet 5 | $0.00036 | $0.00178 |
| Haiku 4.5 | $0.00018 | $0.00089 |
Grade C, and why
cmp-qa-prep scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
> `curl -fsSL https://get.maestro.mobile.dev | bash`), or simply `node qa/verify.mjs` which runs Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
> `curl -fsSL https://get.maestro.mobile.dev | bash`), or simply `node qa/verify.mjs` which runs How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cmp-qa-prep — E2E harness bring-up for a CMP app
Which harness? Check the repo first. Current scaffolds ship Maestro (
qa/e2e/*.yaml) — bring-up is: emulator +installDebug+maestro test qa/e2e/smoke.yaml(CLI:curl -fsSL https://get.maestro.mobile.dev | bash), or simplynode qa/verify.mjswhich runs the whole lane including e2eSmoke. The Appium mechanics below apply only to legacy pre-Maestro projects that actually containqa/appium//tests/appium/.
Your job: take an already-scaffolded CMP/KMP project to a running, smoke-passing app on an Android
emulator. On legacy projects this wraps the template's old qa/appium/ client + smoke runner and
tests/appium/cmp/ config.
Preconditions
- Toolchain present (JDK, Android SDK + AVD, Appium 3.x +
uiautomator2driver). If not, run cmp-doctor first. - A scaffolded project with the E2E harness enabled (the
e2etoggle in cmp-new — renamed fromappiumin 0.3.0). If the project was scaffolded with the harness off, say so — there is no harness to bring up.
Bring-up sequence (legacy Appium path)
- Disk check first (builds fail with "No space left on device"):
df -h ~— want ≥ 3 GB free. - Boot an emulator from the AVD that
cmp-doctorcreated (emulator -avd <name>/adb wait-for-device). - Build + install the debug app:
./gradlew :composeApp:installDebug(exit 0 = success). - Reverse-port any local services the harness needs (
adb reverse), if applicable. - Start Appium + create a session. Prefer the Appium MCP tools (
appium_session_managementwithaction=create, UiAutomator2 caps) over raw CLI when an MCP session is available; otherwise startappiumand connect the harness client inqa/appium/. - Run the smoke — the sample smoke that asserts the bottom nav renders
(
tests/appium/cmp/). This is the same north-star proof the engine's--verifyuses.
Locator hygiene (Appium)
Prefer accessibility id / id over long XPath. Use scroll_to_element for off-screen targets rather
than re-querying. Use gestures for taps/drags. Don't assert on screenshots/pixels — assert on the
element tree.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 59 lines · 182 tokens per session scan C a8796c878232
cmp-qa-prep is a skill published in the GitHub repository kvdm-co-pilot/create-cmp (0 stars, last pushed 5d ago), licensed MIT. It adds 182 tokens to every session and 892 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
compose-multiplatform
Use when building one shared Compose UI in Kotlin across Android, iOS, and desktop — commonMain @Composables, expect/actual, source-set placement, native interop, multiplatform ViewModel/navigation/Koin. NOT a single-platform native build (that is kotlin-android / swift-ios), and NOT Dart/Flutter cross-platform UI…
m3-expressive
Material 3 Expressive design patterns for Jetpack Compose - expressive theming, motion physics, shape morphing, typography emphasis, color emphasis, and all 28 expressive components.
android-device-integrity
Android app/device integrity and anti-fraud for a fintech app — the Play Integrity API (com.google.android.play:integrity): Standard requests (StandardIntegrityManager.prepareIntegrityToken → StandardIntegrityTokenProvider.request with a requestHash → StandardIntegrityToken) vs Classic requests…
mobile-session-security
KMP + iOS/Android session hardening for a fintech app — inactivity auto-lock (track last-interaction, idle timeout, biometric/passcode re-auth), biometric re-lock on background/foreground with a grace period, and screen-capture/snapshot protection. Android: WindowManager FLAGSECURE (blocks screenshots + recents…
push-notifications
Push notification patterns - FCM setup for Android, APNs for iOS, notification channels, payload handling, foreground/background behavior, and rich notifications.
app-clips
Build iOS App Clips for a fintech app — App Clip target + entitlements (com.apple.developer.on-demand-install-capable, parent-application-identifiers, associated-appclip-app-identifiers, associated-domains appclips:), invocation URLs, App Clip Codes / NFC / QR / Safari App Clip banner + Smart App Banner…