claude-tap is a local proxy and trace viewer for AI coding agents, recording and displaying their API requests, prompts, tool calls, responses, context, and token usage. It helps developers inspect and compare agent runs from tools such as Claude Code, Codex CLI, Gemini CLI, Cursor CLI, and others, while the catalogue skills and instruction support work with the project.
Borrowing it
Nothing to install: this file belongs to liaohch3/claude-tap. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/liaohch3/claude-tap/main/.agents/skills/pr-preflight/SKILL.mdgit clone --depth 1 https://github.com/liaohch3/claude-tapWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liaohch3/claude-tap/pr-preflight)<a href="https://agentmods.dev/skills/liaohch3/claude-tap/pr-preflight"><img src="https://agentmods.dev/badge/skills/liaohch3/claude-tap/pr-preflight/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liaohch3/claude-tap/pr-preflight"><img src="https://agentmods.dev/badge/skills/liaohch3/claude-tap/pr-preflight.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.00649 |
| Opus 5 | $0.00028 | $0.00324 |
| Sonnet 5 | $0.00011 | $0.00130 |
| Haiku 4.5 | $0.00006 | $0.00065 |
Grade A, and why
pr-preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PR Preflight
One-command merge-readiness check that combines local gates, CI status, and PR policy checks. Mirrors what reviewers look for so issues are caught before review, not during.
Check an existing PR
scripts/check_pr.sh <pr_number>
This runs:
- PR metadata — fetches title, state, draft status, merge state, branch info
- CI checks — counts pass/fail/pending GitHub Actions checks
- Local gates — runs lint, format, and tests locally:
uv run ruff check .uv run ruff format --check .uv run pytest tests/ -x --timeout=60
- PR body policy — validates required sections, evidence links, and blocked artifacts
- Verdict —
READYorNOT_READYwith specific reasons
Options
| Flag | Purpose |
|---|---|
--repo OWNER/REPO |
Override repository (default: auto-detect via gh) |
--no-tests |
Skip local test gates (useful when you just want CI + metadata check) |
Exit codes
| Code | Meaning |
|---|---|
| 0 | All checks passed — ready to merge |
| 1 | Script error (missing tool, network failure) |
| 2 | Not ready — at least one check failed |
Run local gates only (no PR needed)
If you haven't opened a PR yet and just want to validate locally:
uv run ruff check . && uv run ruff format --check . && uv run pytest tests/ -x --timeout=60
Or use the pre-commit hook (auto-runs lint on commit):
git config core.hooksPath .githooks
What blocks merge
The script reports NOT_READY if any of these are true:
- PR is not in OPEN state
- PR is still a draft
- Merge state is not CLEAN or HAS_HOOKS
- Any CI check is failing
- Any CI check is still pending
- Local gates (lint/format/tests) fail
- PR body policy fails, such as missing evidence for runtime/viewer/client changes
Typical workflow
# 1. Make sure local gates pass
uv run ruff check . && uv run ruff format --check . && uv run pytest tests/ -x --timeout=60
# 2. Push and open PR
git push origin my-branch
gh pr create --title "feat: ..." --body "..."
# 3. Wait for CI, then run full preflight
scripts/check_pr.sh <pr_number>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 80 lines · 57 tokens per session scan A 20619674b07d
pr-preflight is a skill published in the GitHub repository liaohch3/claude-tap (3,181 stars, last pushed 13d ago), licensed MIT. It adds 57 tokens to every session and 649 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
recipe-eval-prompt
Compares original and optimized prompts through repeated blind paired execution in git worktrees. Use when evaluating prompt improvement effects or learning prompt engineering through concrete examples.
java-development
Develop, debug, test, or review Java/JVM repositories without guessing their stack. Use for Java, Maven, Gradle, JUnit, Mockito, Testcontainers, Spring Boot, JVM toolchains, build failures, test failures, coverage, or Java CI work. Discovers wrappers and pinned JDK settings first, preserves project conventions, uses…
playwright-stability
Make a Playwright E2E suite stable and realistic — kill flaky tests and authenticate like a real user via storageState (login once, reuse). Use when E2E tests are flaky, slow, re-login in every test, mock auth instead of using it, or when hardening a suite before relying on it.
mcp-tool-developer
Build Model Context Protocol (MCP) servers and tools from scratch. Full-stack MCP development with TypeScript/Python, testing, deployment, and registry publishing.
prodcheck
Senior-engineer production-readiness review of code changes. Verifies every finding against the real codebase before reporting it — no speculative or pattern-matched advice. Focuses on security, authz and tenant data isolation, N+1 and other database problems, correctness under concurrency, and failure modes. Use when…
prodtest
Senior-QA test pass on a newly implemented feature. Detects the project's real test stack, writes unit and functional/integration tests, then drives the running app with Playwright for end-to-end coverage, saving screenshots to a gitignored folder for human review. Asks upfront whether found bugs should be fixed or…