Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lykhoyda/rn-dev-agent/rn-setupnpx skills add Lykhoyda/rn-dev-agent --skill rn-setupgit clone --depth 1 https://github.com/Lykhoyda/rn-dev-agentWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00113 | $0.07169 |
| Opus 5 | $0.00056 | $0.03585 |
| Sonnet 5 | $0.00023 | $0.01434 |
| Haiku 4.5 | $0.00011 | $0.00717 |
Grade B, and why
rn-setup scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Suggesting `sudo npm install -g` without first checking if nvm is available Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
LATEST=$(curl -fsSL --max-time 3 https://api.github.com/repos/Lykhoyda/rn-dev-agent/releases/latest 2>/dev/null | jq -r '.tag_name // empty' | sed 's/^v//') How it starts
The opening of the file, as written. The whole thing — 361 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Environment Setup & Dependency Check
You are helping a developer set up the rn-dev-agent plugin environment. This skill checks every prerequisite and installs missing dependencies.
When to use
- First time using the plugin
- After SessionStart shows WARNING messages about missing tools
- When
cdp_statusfails to connect - When
device_*tools fail with "session not open" or "command not found" - When the user runs
/rn-dev-agent:setup
Checklist — run each check in order
Resolve APP_ROOT to the exact existing target React Native app directory before
starting the checklist. Use the app selected by the user or the uniquely matching
app from the available project evidence; in a monorepo, use the nested app
directory rather than the repository root. If multiple candidates remain, ask
which app is authoritative. Never run check 0 with APP_ROOT unset or empty.
0. Source declaration (non-Git app roots only)
The session binds one source identity before any setup or build step runs. A Git
app root is detected automatically and declares nothing. A non-Git app root has
no such identity and must declare one explicitly, or every authoritative tool
refuses with NON_GIT_MANIFEST_REQUIRED.
git -C "$APP_ROOT" rev-parse --show-toplevel 2>/dev/null && echo GIT || echo NON_GIT
GIT → report N/A (Git worktree) and move on. NON_GIT → check the
supervisor environment for RN_DEV_AGENT_DECLARED_ROOT and
RN_DEV_AGENT_DECLARED_MANIFESTS. Report MISSING_ROOT,
MISSING_MANIFEST_LIST, or MISSING_MANIFEST, then point to the
session-authority contract.
Setup diagnoses this preflight; it never supplies a declaration.
1. Node.js version
node --version
Required: Node.js >= 24. Every later major, including odd-numbered releases, is supported. If < 24: warn the user to install a supported Node release.
- If
nvmis installed (command -v nvm):nvm install 24 && nvm use 24 - If
fnmis installed:fnm install 24 && fnm use 24 - Otherwise: download from https://nodejs.org/en/download/ or
brew install node@24
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 361 lines · 113 tokens per session scan B e6fccf22f6aa
rn-setup is a skill published in the GitHub repository Lykhoyda/rn-dev-agent (11 stars, last pushed 2d ago), licensed MIT. It adds 113 tokens to every session and 7,169 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
skill-packager
Authors Agent Skills v1.0 packages (SKILL.md plus references/scripts), runs packageskill to produce a standards-compliant zip, and uses installskill to add skills from HTTPS, registry, workspace, or an uploaded archive. Use when the user wants to turn documentation, workflows, or code into a portable skill, export a…
document-processor
Guidance for processing documents, extracting content, and transforming structured information. Use when the user asks to process, parse, extract, or transform document content such as PDFs, Word files, or spreadsheets.
workflow-helper
Guidance for creating, managing and executing workflow automations that chain multiple tools and agents together. Use when the user asks about building, listing, running or composing workflows and automated task pipelines.
attendance-signin-sheet
Generate printable attendance / 签到表 spreadsheets from name lists. Use when the user asks for 签到表, attendance sheet, meeting sign-in table, or similar printable roster tables (not full payroll attendance scoring unless asked).
data-analyzer
Guidance for analyzing structured data, generating statistics and producing data-driven insights. Use when the user asks to analyze data, compute statistics, find patterns, or generate analytical reports.
procurement-audit
Review procurement contracts and purchase packages against uploaded compliance rules (招标/采购制度). Use for 采购审核, contract compliance checklists, or procurement statistics rollups.