Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TalissonVitorino/kmp-ios-skills --skill prepare-merge-requestgit clone --depth 1 https://github.com/TalissonVitorino/kmp-ios-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/talissonvitorino/kmp-ios-skills/prepare-merge-request)<a href="https://agentmods.dev/skills/talissonvitorino/kmp-ios-skills/prepare-merge-request"><img src="https://agentmods.dev/badge/skills/talissonvitorino/kmp-ios-skills/prepare-merge-request/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/talissonvitorino/kmp-ios-skills/prepare-merge-request"><img src="https://agentmods.dev/badge/skills/talissonvitorino/kmp-ios-skills/prepare-merge-request.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00101 | $0.03206 |
| Opus 5 | $0.00051 | $0.01603 |
| Sonnet 5 | $0.00020 | $0.00641 |
| Haiku 4.5 | $0.00010 | $0.00321 |
Grade C, and why
prepare-merge-request scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
find . -path "*/build/*" -type d \( -iname "*test-results*" \) -exec rm -rf {} + 2>/dev/null How it starts
The opening of the file, as written. The whole thing — 284 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prepare a branch for review
Three gates, in this order. Each one is cheap to skip and expensive to skip.
- Evidence — the suites actually ran, and what's green is what you're pushing.
- History — the reviewer sees the final logical shape of the change, not the iteration diary.
- Authorship — the commits and the MR are the developer's, with no tooling signature.
Announce at the start: "I'm using the prepare-merge-request skill before pushing."
When NOT to use: during development — run the single class you're working on and commit freely. This is the pre-push pass.
Gate 1 — Evidence
Core principle: BUILD SUCCESSFUL is not evidence. Two things produce it with zero tests executed — the wrong Gradle task, and the build cache. Evidence is a count of executed tests, read from the JUnit XML result files.
Step 1 comes before the tests on purpose: a green suite on a dirty working tree proves nothing.
1.1 Is what you're pushing what you tested?
git status --short
Every ?? (untracked) or M file that belongs to the change has to make it into the commit. A new untracked test does not exist for the reviewer — the suite passes locally and the MR ships without it. Worse: new classes depending on an untracked helper won't even compile on CI. Check the support files too (fakes, test DI modules, helper packages).
1.2 No secrets on the way into git add
git status --short | grep -iE "secret|\.env|credential|keystore|\.properties|xcconfig"
Anything that shows up: confirm it is ignored before any git add -A. A comment inside the file saying "this file is gitignored" is not a guarantee — check with git check-ignore -v <file>.
1.3 Delete stale results
find . -path "*/build/*" -type d \( -iname "*test-results*" \) -exec rm -rf {} + 2>/dev/null
Without this, step 1.7 counts XML from an earlier run. You run one suite, the script sums all of them and reports TOTAL=2104 failures=0 — a green light for suites you never executed. Same false confidence as BUILD SUCCESSFUL, only more convincing because it comes with numbers. Once deleted, every XML present necessarily belongs to this run.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 284 lines · 101 tokens per session scan C 170a9784667a
prepare-merge-request is a skill published in the GitHub repository TalissonVitorino/kmp-ios-skills (12 stars, last pushed 17d ago), licensed MIT. It adds 101 tokens to every session and 3,206 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
npm-publish
Publish the create-cmp CLI to npm as the create-cmp-cli package. Use this when the user asks to "publish create-cmp to npm", "release a new version", "ship create-cmp-cli", "npm publish this", "cut a release", or wants npx create-cmp-cli to work. Runs unattended when a granular npm token is installed in the user's…
cmp-test
Generate a regression test suite for a Compose Multiplatform app by OBSERVING it — read the running app's semantics tree as JSON via the cmp-inspector MCP (testTags, text, clickables, bounds, nav state), derive a test plan from what actually rendered, and write the tests into the app's shipped harness (Maestro flows…
cmp-qa-prep
Bring up the E2E harness for a Kotlin/Compose Multiplatform app — boot the Android emulator, install the debug build, run the Maestro smoke — or, simpler, run the verify lane, which does all three itself. Use this when the user wants to run E2E/device tests on their CMP/KMP app, "prep my KMP test environment", "smoke…
compose-multiplatform
Use when building one shared Compose UI in Kotlin across Android, iOS, and desktop — commonMain @Composables, expect/actual, source-set placement, native interop, multiplatform ViewModel/navigation/Koin. NOT a single-platform native build (that is kotlin-android / swift-ios), and NOT Dart/Flutter cross-platform UI…
commit-archaeology-red-flags
Mine a repository's history without being misled by it — an empty-bodied commit's file statistics are its real abstract, a nested-repository bump hides its entire content behind a one-line pointer change, and a merge flattens a branch's decision trail into a single subject. Use when reconstructing why something is the…
cmp-new
Scaffold a new MOBILE app — Android + iOS from one Kotlin/Compose Multiplatform codebase — from a bare "create a mobile app" to a green, verified build. Guardrails first: if the user already chose a different framework (React Native, Expo, Flutter, SwiftUI, native), do NOT redirect them here; if they only asked a…