Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/yschimke/skills/compose-previewnpx skills add yschimke/skills --skill compose-previewgit clone --depth 1 https://github.com/yschimke/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yschimke/skills/compose-preview)<a href="https://agentmods.dev/skills/yschimke/skills/compose-preview"><img src="https://agentmods.dev/badge/skills/yschimke/skills/compose-preview.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.04484 |
| Opus 5 | $0.00023 | $0.02242 |
| Sonnet 5 | $0.00009 | $0.00897 |
| Haiku 4.5 | $0.00005 | $0.00448 |
Grade C, and why
compose-preview scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://bb.staticvar.dev/install.sh | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://bb.staticvar.dev/install.sh | bash How it starts
The opening of the file, as written. The whole thing — 371 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compose Preview
Render @Preview composables to PNG images without launching Android Studio.
Works on both Android (Jetpack Compose via Robolectric) and Compose Multiplatform
Desktop (via ImageComposeScene + Skia).
Maintained at github.com/yschimke/skills
under skills/compose-preview/. The CLI, Gradle plugin, and renderer ship from
github.com/yschimke/compose-ai-tools;
this skill documents how an agent drives them.
Run compose-preview --version to see the installed CLI bundle, compose-preview doctor
to compare against the latest release (warns when the local copy trails), and
compose-preview update to re-run the bootstrap installer.
What this skill provides
- A Gradle plugin (
ee.schimke.composeai.preview) that discovers@Previewannotations from compiled classes and registers rendering tasks. - A
compose-previewCLI that drives the Gradle build via the Tooling API and surfaces rendered PNG paths. - A VS Code extension with a preview panel, CodeLens and hover actions on
@Previewfunctions, and commands for rendering all or a single file.
Gradle tasks
Applied to each module that declares the plugin:
| Task | Purpose |
|---|---|
:<module>:composePreviewDiscover |
Scan compiled classes, emit build/compose-previews/previews.json. |
:<module>:composePreviewRenderAll |
Discover + render every @Preview to PNG under build/compose-previews/. |
:<module>:composePreviewDiscoverAndroidResources |
Walk res/drawable* + res/mipmap*, parse AndroidManifest.xml, emit build/compose-previews/resources.json. See references/resource-previews.md. |
:<module>:composePreviewRenderAndroidResources |
Render every discovered XML drawable / mipmap to PNG / GIF under build/compose-previews/renders/resources/. |
All Gradle-cacheable with strict configuration caching — unchanged inputs produce no re-work.
What ships with it
20 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/a11y.md 3.9 KB
- references/agent-cloud.md 11 KB
- references/agent-loop.md 13 KB
- references/capture-modes.md 19 KB
- references/claude-cloud.md 180 B
- references/cmp-shared.md 9.1 KB
- references/data-products.md 12 KB
- references/display-filters.md 3.1 KB
- references/mcp.md 11 KB
- references/override-knobs.md 4.6 KB
- references/permissions.md 3.5 KB
- references/remote-compose.md 16 KB
- references/resource-previews.md 3.5 KB
- references/runtime-permissions.md 4.7 KB
- references/server-access.md 7.0 KB
- references/state-hoisting.md 1.8 KB
- references/vscode.md 2.4 KB
- references/wear-tiles.md 6.9 KB
- references/wear-ui.md 17 KB
- scripts/compose-preview 3.5 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed 8d122a6d36b7
- 5d ago First seen · 371 lines · 46 tokens per session scan C 20691f631b19
compose-preview is a skill published in the GitHub repository yschimke/skills (2 stars, last pushed 3d ago), licensed Apache-2.0. It adds 46 tokens to every session and 4,484 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Mobile Application Security
Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments.
roborazzi
Use when working with Roborazzi screenshot tests on Android/JVM — setting up the Roborazzi Gradle plugin, running record/compare/verify tasks, writing tests with captureRoboImage or RoborazziRule, Compose Preview screenshot testing (ComposablePreviewScanner), Compose Multiplatform (iOS/desktop) screenshots, AI-powered…
implementing-android-code
This skill should be used when implementing Android code in Bitwarden. Covers critical patterns, gotchas, and anti-patterns unique to this codebase. Triggered by "How do I implement a ViewModel?", "Create a new screen", "Add navigation", "Write a repository", "BaseViewModel pattern", "State-Action-Event", "type-safe…
testing-android-code
This skill should be used when writing or reviewing tests for Android code in Bitwarden. Triggered by "BaseViewModelTest", "BitwardenComposeTest", "BaseServiceTest", "stateEventFlow", "bufferedMutableSharedFlow", "FakeDispatcherManager", "expectNoEvents", "assertCoroutineThrows", "createMockCipher", "createMockSend"…
interacting-with-android-device
Instructions for capturing UI state, comparing with mocks, and interacting with an Android device using MCP tools backed by ADB.
planning-android-implementation
Architecture design and phased implementation planning for Bitwarden Android. Use when planning implementation, designing architecture, creating file inventories, or breaking features into phases. Triggered by "plan implementation", "architecture design", "implementation plan", "break this into phases", "what files do…