Subwave is an internet radio station where an AI DJ selects music and speaks between tracks for every listener at once. Listeners can request music in plain language, while operators manage the queue, schedule, DJ personas, and station activity. Its catalogue entries define skills and workflows for operating the station.
Borrowing it
Nothing to install: this file belongs to perminder-klair/subwave. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/perminder-klair/subwave/develop/.claude/skills/subwave-app-ios-release/SKILL.mdgit clone --depth 1 https://github.com/perminder-klair/subwaveWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/perminder-klair/subwave/subwave-app-ios-release)<a href="https://agentmods.dev/skills/perminder-klair/subwave/subwave-app-ios-release"><img src="https://agentmods.dev/badge/skills/perminder-klair/subwave/subwave-app-ios-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/perminder-klair/subwave/subwave-app-ios-release"><img src="https://agentmods.dev/badge/skills/perminder-klair/subwave/subwave-app-ios-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 39 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium MCP Rug Pull · line 41 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00288 | $0.03266 |
| Opus 5 | $0.00144 | $0.01633 |
| Sonnet 5 | $0.00058 | $0.00653 |
| Haiku 4.5 | $0.00029 | $0.00327 |
Grade A, and why
subwave-app-ios-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 250 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SUB/WAVE iOS release → TestFlight
Build a fresh iOS binary in the cloud and push it to TestFlight. All the
painful one-time setup is already done — signing credentials live on EAS, the
App Store Connect app record exists, and eas.json is wired — so a normal
release is a single command. This skill is about doing it again, reliably, and
knowing what to check.
Why this is now easy
The first release required interactive setup (creating a distribution
certificate, registering the App Store Connect app). That's finished. EAS stores
the credentials server-side and app/eas.json pins the submit target, so repeat
builds run non-interactively — no Xcode, no Apple login prompts, no TTY.
First: does this even need a new build? (OTA)
The app ships expo-updates (OTA). If the change is JS/TS only — components, hooks, styles, copy, logic, Metro-bundled assets — you do not need a TestFlight build at all. Push it over-the-air to the binaries already out there:
cd "$APP"
eas update --channel production --message "fix: …" # testers first: --channel preview
It reaches every installed build whose runtime version (fingerprint) matches —
i.e. any build with the same native code. Testers see it on the next cold
start (it fetches in the background; fallbackToCacheTimeout: 0 keeps launch
instant, so killing + relaunching twice is how you confirm it applied).
A new binary is only required when native inputs changed: a dependency
add/upgrade, anything under app/patches/, a config plugin, or app.json's
ios/infoPlist/plugins sections. The fingerprint policy guarantees an OTA
can't land on a binary with mismatched native code, so you can't break a build
this way. Rule of thumb: ran npx expo install or touched patches/? → build a
binary. Otherwise → OTA. Full decision table + fingerprint debugging:
app/docs/RELEASE.md.
The rest of this skill is the binary path (native change, or a store release).
Fixed facts about this app
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +9 lines 87956669cf26
- 9d ago First seen · 241 lines · 288 tokens per session scan A 5506238d7d94
subwave-app-ios-release is a skill published in the GitHub repository perminder-klair/subwave (1,309 stars, last pushed yesterday), licensed MIT. It adds 288 tokens to every session and 3,266 once invoked, about $0.0014 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
axiom-shipping
Use when preparing ANY app for submission, handling App Store rejections, writing appeals, or managing App Store Connect. Covers submission checklists, rejection troubleshooting, metadata requirements, privacy manifests, age ratings, export compliance.
asc-ad-hoc-distribution
Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned S3-compatible storage, or diagnosing a resumable private distribution run.
release-new-version
Use when the user wants to release a new Zafiro version — drafting bilingual release notes, deciding the next version number, bumping app/build.gradle.kts, tagging, and publishing to GitHub (main repo, optionally the Xposed repo).
suede-play-release
Suede Labs Google Play delivery skill: ship an Android release end to end from the agent interface, without opening the Play Console. Set up credentials, upload an AAB, promote between tracks, stage or complete a rollout, push per-locale release notes, and prove against the Play Developer API what is actually live.…
app-release
End-to-end pipeline for releasing an iOS / watchOS app to TestFlight and the App Store. Use when the user wants to publish, ship, or release an iOS/watchOS app, get a build onto TestFlight, archive and upload via xcodebuild, deploy a CloudKit schema to Production, set App Privacy or export compliance, mint a…
testflight-release
Ship a new TestFlight build of the iOS companion (TermioMobile) — resolve the next build number against App Store Connect, archive, sign, export, upload, write the What to Test notes, and distribute. Invoke when the user says 'ship a testflight build', 'update testflight', 'upload to testflight', 'new beta build'…