Subwave is an internet radio station where an AI DJ selects music and speaks between tracks for every listener at once. Listeners can request music in plain language, while operators manage the queue, schedule, DJ personas, and station activity. Its catalogue entries define skills and workflows for operating the station.
Borrowing it
Nothing to install: this file belongs to perminder-klair/subwave. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/perminder-klair/subwave/develop/.claude/skills/subwave-app-android-release/SKILL.mdgit clone --depth 1 https://github.com/perminder-klair/subwaveWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/perminder-klair/subwave/subwave-app-android-release)<a href="https://agentmods.dev/skills/perminder-klair/subwave/subwave-app-android-release"><img src="https://agentmods.dev/badge/skills/perminder-klair/subwave/subwave-app-android-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/perminder-klair/subwave/subwave-app-android-release"><img src="https://agentmods.dev/badge/skills/perminder-klair/subwave/subwave-app-android-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 46 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Rogue Agent · line 102 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03637 |
| Opus 5.5 | $0.00000 | $0.01455 |
| Sonnet 5.5 | $0.00000 | $0.00727 |
| Haiku 4.5 | $0.00000 | $0.00364 |
Grade C, and why
subwave-app-android-release scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
`$TMPDIR/eas-build-local-nodejs`; `rm -rf` it before retrying. How it starts
The opening of the file, as written. The whole thing — 266 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SUB/WAVE Android release → Play Store / testers
The app is live in production on the Google Play Store. There are two ways to ship a fresh Android binary, and which you want depends on the audience:
- Play Store release (
productionprofile) — builds a signed.aabApp Bundle on EAS. You then upload it to the Play Console by hand (submission is manual — see the Play Store section). This is how real users get the update. - Quick sideload test (
previewprofile) — builds an APK and returns an install link + QR any Android phone can tap, no Google account involved. Good for handing a build to a trusted tester fast, outside the Play Store machinery.
Either way EAS generates+stores the signing keystore for you. Ask which one the
user wants if it's ambiguous — "release"/"ship to the store" → production
.aab; "send to a tester"/"install link" → preview APK.
For a phone you can physically plug in (USB/adb, live hot-reload), use the local
subwave-app-android skill instead.
First: does this even need a new build? (OTA)
The app ships expo-updates (OTA). If the change is JS/TS only — components, hooks, styles, copy, logic, Metro-bundled assets — you do not need a new APK/AAB. Push it over-the-air to the binaries already installed:
cd "$APP"
eas update --channel preview --message "fix: …" # tester (internal-APK) builds
eas update --channel production --message "fix: …" # Play builds
It reaches every installed build whose runtime version (fingerprint) matches.
Testers see it on the next cold start (it fetches in the background;
fallbackToCacheTimeout: 0 keeps launch instant, so kill + relaunch twice to
confirm it applied).
A new build is only required when native inputs changed: a dependency
add/upgrade, anything under app/patches/, a config plugin, or app.json's
android/plugins sections. The fingerprint policy guarantees an OTA can't land
on a binary with mismatched native code. Rule of thumb: ran npx expo install
or touched patches/? → build. Otherwise → OTA. Full decision table:
app/docs/RELEASE.md.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +4 lines f8866c44a48c
- 2mo ago First seen · 262 lines · 0 tokens per session scan C 3616c053aa79
subwave-app-android-release is a skill published in the GitHub repository perminder-klair/subwave (1,568 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,637 tokens. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
axiom-shipping
Use when preparing an app for App Store submission, handling rejections or appeals, managing App Store Connect and Xcode Cloud, or triaging TestFlight/Sentry crash corpora. Covers checklists, metadata, privacy manifests, age ratings, export compliance.
release-new-version
Use when the user wants to release a new Zafiro version — drafting bilingual release notes, deciding the next version number, bumping app/build.gradle.kts, tagging, and publishing to GitHub (main repo, optionally the Xposed repo).
asc-ad-hoc-distribution
Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned S3-compatible storage, or diagnosing a resumable private distribution run.
testflight-release
Ship a new TestFlight build of the iOS companion (TermioMobile) — resolve the next build number against App Store Connect, archive, sign, export, upload, write the What to Test notes, and distribute. Invoke when the user says 'ship a testflight build', 'update testflight', 'upload to testflight', 'new beta build'…
suede-play-release
Suede AI Google Play Release Skills. Google Play release delivery with AAB preflight, test-track upload, exact versionCode promotion, staged rollout, locale notes, and API readback. Use when asked "promote this Android build" or to diagnose Play publishing access and prove the served release. NOT FOR: app building or…
app-release
End-to-end pipeline for releasing an iOS / watchOS app to TestFlight and the App Store. Use when the user wants to publish, ship, or release an iOS/watchOS app, get a build onto TestFlight, archive and upload via xcodebuild, deploy a CloudKit schema to Production, set App Privacy or export compliance, mint a…