Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wsauret/flywheel --skill ios-uatgit clone --depth 1 https://github.com/wsauret/flywheelWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wsauret/flywheel/ios-uat)<a href="https://agentmods.dev/skills/wsauret/flywheel/ios-uat"><img src="https://agentmods.dev/badge/skills/wsauret/flywheel/ios-uat/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wsauret/flywheel/ios-uat"><img src="https://agentmods.dev/badge/skills/wsauret/flywheel/ios-uat.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.01266 |
| Opus 5.5 | $0.00008 | $0.00506 |
| Sonnet 5.5 | $0.00004 | $0.00253 |
| Haiku 4.5 | $0.00002 | $0.00127 |
Grade A, and why
ios-uat scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 24 lines — stays where its author put it; the contents beside it link to each section on GitHub.
iOS UAT
Input: phone acceptance criteria, source revision, the page under test (hosted app, local preview, or a probe page), and a session scratch directory.
Compose generic UAT. Use ios_simulator for simulator observation and interaction. Start with simulator list, boot one shutdown iPhone when needed, and open the Simulator frontend before anything else so the person can watch. A missing full Xcode install, iOS runtime, pinned XcodeBuildMCP backend, or bundled AXe support is blocked; return the exact tool failure and the remediation it gives. Never click the Simulator through host-window coordinates, macOS Accessibility, or desktop mouse automation.
Use the schema action for a workflow before an unfamiliar call; it returns every allowlisted action and the pinned backend's exact argument schema. Before an interaction, capture a semantic snapshot with ui-automation snapshot-ui. Pass each action's parameters in the arguments object and pass the returned top-level snapshotToken with every action that can consume an element ref. Act only on an element ref whose target lists the requested action. After any UI action, every old token and element ref is stale: capture a fresh semantic snapshot before the next element-ref action. Use ui-automation tap, type-text, swipe, and wait-for-ui for ordinary semantic input. If a web surface is absent from the semantic tree, capture a simulator screenshot and use ui-automation tap-point with device-point coordinates from that screenshot. Device points are not host-window coordinates. Use simulator screenshot or ui-automation screenshot after the resulting state settles; screenshots are the visual record, while semantic snapshots establish which accessible control received a semantic action.
The Simulator shares the host's loopback, so a server on localhost is reachable from Safari and no tunnel is needed. Navigate through Safari's semantic controls, including its address field, instead of injecting host clicks. A pairing link opened in Safari pairs that tab; the Home Screen app is a separate origin with its own device store and pairs again, which is the same fact the install guide states. Use the allowlisted simulator-management actions for appearance and keyboard display. Install to the Home Screen through Safari's own semantic controls: More, Share, View More, Add to Home Screen, Add. Web clips run under com.apple.webapp; relaunch through visible UI when a criterion must load new code. Facts an installed app must be judged against on iOS 26: display-mode: standalone is false and navigator.standalone is true; the layout viewport is the screen minus the status bar and is anchored at the top, so 100%, dvh, and svh stop a status bar short of the bottom while lvh is the whole screen; the visual viewport shrinks to the area above the keyboard; a focused field below 16px zooms the page and the zoom outlives the blur. When a layout question is open, measure before fixing: write a probe page under the session scratch that prints screen, innerHeight, the viewport units, visualViewport, the safe-area insets, and the rectangles of the elements in question, serve it on loopback, install it beside the app, and read the numbers with the keyboard closed and open.
For any change to the phone's keyboard handling, composer, or chat layout, run scripts/uat/phone-soft-keyboard.ts; its header states the setup. It serves the hosted phone page with a per-frame layout sampler, focuses and dismisses the composer through AXe touches, and judges each change from the trace and from a screen recording. Only the recording sees motion that iOS adds outside the page's layout, such as the page sliding while the keyboard rises. One hardware key event, including an AXe type or a Cmd+V paste after simctl pbcopy, makes iOS show only the keyboard's accessory bar on focus. Before a keyboard run, set HardwareKeyboardLastSeen and AutomaticMinimizationEnabled to false in com.apple.keyboard.preferences and reboot the device. Only one host recording can run on a machine, so a live simulator panel in another session makes the recording fail.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 24 lines · 21 tokens per session scan A 7e7f637eba15
ios-uat is a skill published in the GitHub repository wsauret/flywheel (19 stars, last pushed yesterday), licensed Apache-2.0. It adds 21 tokens to every session and 1,266 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-03.
ios-uat compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| ios-uatwsauret/flywheel | Skill | 19 | yesterday | Apache-2.0 | A | 21 | Claude Code, Codex |
| verifyHmbown/CodeWhale | Skill | 41k | 5d ago | MIT | A | 25 | Claude Code, Codex |
| webapp-testingHmbown/CodeWhale | Skill | 41k | 5d ago | MIT | A | 32 | Claude Code, Codex |
| test-xcodegvkhosla/compound-engineering-pi | Skill | 52 | 1mo ago | MIT | A | 18 | Claude Code |
| device-interactionaduermael/herm | Skill | 233 | 2mo ago | MIT | A | 23 | Claude Code, Codex |
| e2e-test-engineerlfyxhappy/lfcode | Skill | 2 | 1mo ago | MIT | A | 62 | Claude Code, Codex |
| visual-regression-testerlfyxhappy/lfcode | Skill | 2 | 1mo ago | MIT | A | 57 | Claude Code, Codex |