claude-tap is a local proxy and trace viewer for AI coding agents, recording and displaying their API requests, prompts, tool calls, responses, context, and token usage. It helps developers inspect and compare agent runs from tools such as Claude Code, Codex CLI, Gemini CLI, Cursor CLI, and others, while the catalogue skills and instruction support work with the project.
Borrowing it
Nothing to install: this file belongs to liaohch3/claude-tap. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/liaohch3/claude-tap/main/.agents/skills/pr-preflight/SKILL.mdgit clone --depth 1 https://github.com/liaohch3/claude-tapWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liaohch3/claude-tap/pr-preflight)<a href="https://agentmods.dev/skills/liaohch3/claude-tap/pr-preflight"><img src="https://agentmods.dev/badge/skills/liaohch3/claude-tap/pr-preflight/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liaohch3/claude-tap/pr-preflight"><img src="https://agentmods.dev/badge/skills/liaohch3/claude-tap/pr-preflight.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.00649 |
| Opus 5.5 | $0.00023 | $0.00260 |
| Sonnet 5.5 | $0.00011 | $0.00130 |
| Haiku 4.5 | $0.00006 | $0.00065 |
Grade A, and why
pr-preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PR Preflight
One-command merge-readiness check that combines local gates, CI status, and PR policy checks. Mirrors what reviewers look for so issues are caught before review, not during.
Check an existing PR
scripts/check_pr.sh <pr_number>
This runs:
- PR metadata — fetches title, state, draft status, merge state, branch info
- CI checks — counts pass/fail/pending GitHub Actions checks
- Local gates — runs lint, format, and tests locally:
uv run ruff check .uv run ruff format --check .uv run pytest tests/ -x --timeout=60
- PR body policy — validates required sections, evidence links, and blocked artifacts
- Verdict —
READYorNOT_READYwith specific reasons
Options
| Flag | Purpose |
|---|---|
--repo OWNER/REPO |
Override repository (default: auto-detect via gh) |
--no-tests |
Skip local test gates (useful when you just want CI + metadata check) |
Exit codes
| Code | Meaning |
|---|---|
| 0 | All checks passed — ready to merge |
| 1 | Script error (missing tool, network failure) |
| 2 | Not ready — at least one check failed |
Run local gates only (no PR needed)
If you haven't opened a PR yet and just want to validate locally:
uv run ruff check . && uv run ruff format --check . && uv run pytest tests/ -x --timeout=60
Or use the pre-commit hook (auto-runs lint on commit):
git config core.hooksPath .githooks
What blocks merge
The script reports NOT_READY if any of these are true:
- PR is not in OPEN state
- PR is still a draft
- Merge state is not CLEAN or HAS_HOOKS
- Any CI check is failing
- Any CI check is still pending
- Local gates (lint/format/tests) fail
- PR body policy fails, such as missing evidence for runtime/viewer/client changes
Typical workflow
# 1. Make sure local gates pass
uv run ruff check . && uv run ruff format --check . && uv run pytest tests/ -x --timeout=60
# 2. Push and open PR
git push origin my-branch
gh pr create --title "feat: ..." --body "..."
# 3. Wait for CI, then run full preflight
scripts/check_pr.sh <pr_number>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 80 lines · 57 tokens per session scan A 20619674b07d
pr-preflight is a skill published in the GitHub repository liaohch3/claude-tap (3,311 stars, last pushed today), licensed MIT. It adds 57 tokens to every session and 649 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
prodtest
Senior-QA test pass on a newly implemented feature. Detects the project's real test stack, writes unit and functional/integration tests, then drives the running app with Playwright for end-to-end coverage, saving screenshots to a gitignored folder for human review. Asks upfront whether found bugs should be fixed or…
browser-use
Direct browser control via CDP for web interaction: automation, scraping, testing, screenshots, and site/app work. Also covers hosted cloud browsers for AI agents: the browser-use Python library (Browser(usecloud=True)), Playwright, Puppeteer or any CDP client.
review-prs
Review a GitHub pull request in the googleapis/mcp-toolbox repo against the team's reviewer checklist: PR title/description conventions, linked issue, logic errors and unhandled edge cases, breaking changes, test coverage, docs updates, security (input handling), and new dependencies. Use whenever a maintainer asks…
discount-review
Inspect the discount policy fixture with a repeatable review checklist and helper script.
mantis-plan
Formulates a targeted defensive security reviewing plan based on the active threat model and historical learnings. Use when starting a security review campaign to map the codebase boundaries and generate a roadmap (workspace/plan.json). Don't use for executing code reviews, writing test scripts, or patching code.
code-review
Reviews code for bugs, security issues, and best practices.