Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add andersonamaral2/Claude-Code-to-Deep-Agents-Skills-Converter --skill python-fastapi-todo-appgit clone --depth 1 https://github.com/andersonamaral2/Claude-Code-to-Deep-Agents-Skills-ConverterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andersonamaral2/claude-code-to-deep-agents-skills-converter/python-fastapi-todo-app)<a href="https://agentmods.dev/skills/andersonamaral2/claude-code-to-deep-agents-skills-converter/python-fastapi-todo-app"><img src="https://agentmods.dev/badge/skills/andersonamaral2/claude-code-to-deep-agents-skills-converter/python-fastapi-todo-app/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/andersonamaral2/claude-code-to-deep-agents-skills-converter/python-fastapi-todo-app"><img src="https://agentmods.dev/badge/skills/andersonamaral2/claude-code-to-deep-agents-skills-converter/python-fastapi-todo-app.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 70 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Data Exfiltration · line 79 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.00647 |
| Opus 5 | $0.00026 | $0.00324 |
| Sonnet 5 | $0.00010 | $0.00129 |
| Haiku 4.5 | $0.00005 | $0.00065 |
Grade B, and why
python-fastapi-todo-app scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -X POST http://localhost:8000/todos -H "Content-Type: application/json" -d '{"title": "Buy milk", "completed": false}' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl http://localhost:8000/todos How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: Python FastAPI Todo App
Creates a simple Todo API with FastAPI, SQLite, and basic CRUD operations.
When to use
When the user asks to create a todo app, task manager API, or simple REST API with Python.
Steps
First, make sure Python 3.11+ is installed. On macOS use brew install [email protected], on Linux use apt-get install python3.11.
Create the project directory and initialize a virtual environment:
mkdir -p todo-api/app
cd todo-api
python3 -m venv venv
source venv/bin/activate
Install the dependencies:
pip install fastapi uvicorn sqlalchemy
Create the file app/database.py:
from sqlalchemy import create_engine
from sqlalchemy.ext.declarative import declarative_base
from sqlalchemy.orm import sessionmaker
DATABASE_URL = "sqlite:///./todos.db"
engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})
SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
Base = declarative_base()
Create the file app/models.py:
from sqlalchemy import Column, Integer, String, Boolean
from .database import Base
class Todo(Base):
__tablename__ = "todos"
id = Column(Integer, primary_key=True, index=True)
title = Column(String, index=True)
description = Column(String, default="")
completed = Column(Boolean, default=False)
Create app/main.py with the FastAPI app, including these endpoints:
GET /todos— list all todosPOST /todos— create a new todoPUT /todos/{id}— update a todoDELETE /todos/{id}— delete a todo
The app should read $API_HOST and $API_PORT from the environment for the server bind address.
Add the project conventions to AGENTS.md at the root (Cursor reads AGENTS.md and .cursor/rules/ for persistent project context).
Test the API:
curl http://localhost:8000/todos
curl -X POST http://localhost:8000/todos -H "Content-Type: application/json" -d '{"title": "Buy milk", "completed": false}'
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 93 lines · 52 tokens per session scan B 26d53d9e2e1b
python-fastapi-todo-app is a skill published in the GitHub repository andersonamaral2/Claude-Code-to-Deep-Agents-Skills-Converter (57 stars, last pushed yesterday), licensed MIT. It adds 52 tokens to every session and 647 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
stripe-projects
Use after E2B sandbox/API access has been provisioned through Stripe Projects and the user needs to use the resulting E2B API key with the E2B CLI, JavaScript SDK, Python SDK, or Code Interpreter SDK.
azure-messaging-webpubsubservice-py
Azure Web PubSub Service SDK for Python. Use for real-time messaging, WebSocket connections, and pub/sub patterns. Triggers: "azure-messaging-webpubsubservice", "WebPubSubServiceClient", "real-time", "WebSocket", "pub/sub".
azure-mgmt-botservice-py
Azure Bot Service Management SDK for Python. Use for creating, managing, and configuring Azure Bot Service resources. Triggers: "azure-mgmt-botservice", "AzureBotService", "bot management", "conversational AI", "bot channels".
backend
Python server code, APIs, async, strict typing.
fastapi-app
Bootstrap a new FastAPI backend with async SQLAlchemy 2.0, asyncpg, Alembic, Pydantic v2, and no deprecated APIs. Use when the user wants to start, scaffold, or set up a new FastAPI service, a Python REST API, an async backend, or asks to "create a new fastapi app" or "new python backend". Handles JWT auth, layered…
azure-appconfiguration-py
Centralized configuration management with feature flags and dynamic settings.