Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/thisissadeghi/kmpilot/verify-uinpx skills add ThisIsSadeghi/KMPilot --skill verify-uigit clone --depth 1 https://github.com/ThisIsSadeghi/KMPilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thisissadeghi/kmpilot/verify-ui)<a href="https://agentmods.dev/skills/thisissadeghi/kmpilot/verify-ui"><img src="https://agentmods.dev/badge/skills/thisissadeghi/kmpilot/verify-ui.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00030 | $0.11530 |
| Opus 5 | $0.00015 | $0.05765 |
| Sonnet 5 | $0.00006 | $0.02306 |
| Haiku 4.5 | $0.00003 | $0.01153 |
Grade A, and why
verify-ui scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Linux: sudo apt-get install python3 (or your distro's package manager) Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
allowed-tools: Task, Read, Write, Edit, Glob, Grep, Bash(mkdir *), Bash(ls *), Bash(curl *), Bash(rm *), Bash(grep *), Bash(wc *), Bash(./gradlew *), Bash(python3 *), AskUserQuestion, mcp__stitch__get_screen, mcp__stitch How it starts
The opening of the file, as written. The whole thing — 633 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verify UI
Verify a feature's UI implementation matches the Stitch design at the token level. Produces a two-source token audit (HTML ↔ Code) overlaid with an X-component default-render trap checklist, plus an X-components compliance check.
Architecture Reference: @../_shared/patterns.md Rationale & edge cases: @RATIONALE.md (read only when an edge case stumps you)
Prerequisites
- Feature implemented (build passes)
.claude/docs/_project/stitch-project.jsonexists with afeatures[{featurename}]entry
Workflow
[USER INVOKES] → Preflight → Acquire HTML (reuse or download) → Token Extraction → Catalog → Token Audit → Trap Checklist → Component Overrides Check → Motion Audit → X-Components Check → Present Results → Handle Mismatches → Cleanup → DONE
Step 1: Preflight
- Parse feature name from
$ARGUMENTSor ask the user. - Verify required tooling — Python 3 (used by Step 3 to run
.claude/skills/_shared/extract_tokens.py):
If the command fails (python3 --versionpython3: command not found, non-zero exit), STOP and tell the user:
Do not retry or work around the failure — wait for the user to install Python 3.Python 3 is not installed (or `python3` is not on PATH). /verify-ui extracts design tokens from Stitch HTML via `.claude/skills/_shared/extract_tokens.py` and cannot proceed without it. Install Python 3, then re-invoke /verify-ui {featurename}: - macOS: brew install python3 - Linux: sudo apt-get install python3 (or your distro's package manager) - Windows: https://www.python.org/downloads/ (or `winget install Python.Python.3`) Verify with: python3 --version - Verify files exist:
.claude/docs/_project/stitch-project.jsonwithfeatures[{featurename}]entryfeature/{featurename}/src/commonMain/kotlin/**/presentation/ui/
- Verify build passes:
./gradlew :feature:{featurename}:assembleAndroidMain.
Read .claude/docs/_project/stitch-project.json to load:
projectIdand shared state screen IDs (sharedStateScreens.loading.screenId,sharedStateScreens.failed.screenId)- Per-feature screen IDs (
features[featurename].successScreenId,.emptyScreenId) - Per-feature state selections (
features[featurename].states = { loading, failed, empty }). False flags mean the state was skipped at design time and is not audited below. - Secondary screens (
features[featurename].secondaryScreens[]— each{ kind, screenId, role, label, htmlPath, tokensPath, dimensions }, written by/design-uiStep 1.13b). Each is an additional audit unit keyed by itsrole;kind: surface= an overlay (bottom sheet / dialog / modal / drawer / panel),kind: screen= a full sibling screen of the same feature (own Route, reached via callback). Empty/absent → the feature has none; audit nothing extra. - Backward compatibility: if
statesis absent on a legacy feature entry, derive it from observable state —{ loading: true, failed: true, empty: (emptyScreenId != null) }. Pre-optional-states features had loading/failed always present and empty only when anemptyScreenIdwas recorded. IfsecondaryScreensis absent, the feature has no secondary screens.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 633 lines · 30 tokens per session scan A 6e38611dda3b
verify-ui is a skill published in the GitHub repository ThisIsSadeghi/KMPilot (56 stars, last pushed 27d ago), licensed MIT. It adds 30 tokens to every session and 11,530 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
compose-multiplatform
Use when building one shared Compose UI in Kotlin across Android, iOS, and desktop — commonMain @Composables, expect/actual, source-set placement, native interop, multiplatform ViewModel/navigation/Koin. NOT a single-platform native build (that is kotlin-android / swift-ios), and NOT Dart/Flutter cross-platform UI…
kotlin-android
Use when building or fixing a native Android app in Kotlin and Jetpack Compose on the UDF layered architecture — ViewModel/StateFlow, Hilt, Room, Retrofit, coroutines, type-safe Navigation, and the Gradle/AGP surface. NOT shared Android and iOS UI from one Kotlin codebase (that is compose-multiplatform).
modern-jetpack-compose
Guides writing, reviewing, and reasoning about modern Android UI code using Jetpack Compose. Covers best practices for state management, side effects, recomposition, navigation, Material 3 design, accessibility, and performance. Use when reading, writing, or reviewing any Jetpack Compose project.
android-studio
Operational skill for Android Studio: Gradle projects, emulators, Logcat, build variants, signing configs, and AGP troubleshooting.
find-missing-translations
Use when comparing Android strings.xml locale files to find untranslated string resources, missing translation keys, or preparing translation work for a specific language.
android-expert
Android platform patterns for the amethyst/ module. Use when working with (1) Android navigation (Navigation Compose, type-safe routes, bottom nav), (2) runtime permissions (camera, notifications, biometrics), (3) platform APIs (Intent, Context, Activity, ContentResolver), (4) Material3 theming and edge-to-edge UI…