Borrowing it
Nothing to install: this file belongs to BlocUnited-LLC/mozaiks. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/BlocUnited-LLC/mozaiks/main/.agents/skills/setup/SKILL.mdgit clone --depth 1 https://github.com/BlocUnited-LLC/mozaiksWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/blocunited-llc/mozaiks/setup)<a href="https://agentmods.dev/skills/blocunited-llc/mozaiks/setup"><img src="https://agentmods.dev/badge/skills/blocunited-llc/mozaiks/setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/blocunited-llc/mozaiks/setup"><img src="https://agentmods.dev/badge/skills/blocunited-llc/mozaiks/setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 44 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 45 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 97 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.00914 |
| Opus 5.5 | $0.00010 | $0.00366 |
| Sonnet 5.5 | $0.00005 | $0.00183 |
| Haiku 4.5 | $0.00003 | $0.00091 |
Grade A, and why
setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Help the user set up Mozaiks from a fresh clone.
Tier System
Mozaiks supports four development tiers:
| Tier | Use Case | What's Included |
|---|---|---|
| engine | Headless AI API | Workflows only, no UI |
| chat | Chatbot builders | Workflows + chat UI |
| integrated | SaaS builders | + modules + event bus + auth |
| full | Product builders | + admin portal + full management surfaces |
For more info on tiers: /init-project or /add-feature skills.
Prerequisites to Check
Run these commands and verify versions:
- Docker 24+ and Compose v2+
- Python 3.11+
- Node 20.19+ or 22.12+ (Vite 8 requirement), npm 9+
If anything is missing, help them install it first.
Canonical Local Contributor Path
For this repo, the default local contributor experience is:
- Studio host backend on
http://localhost:8000 web_shell/frontend onhttp://localhost:3000factory_app/appas the first-party builder/reference app bundle when no external app workspace is selected
Setup Steps
1. Environment Variables
# Copy .env.example to .env
cp .env.example .env # or Copy-Item on Windows
Set OPENAI_API_KEY=sk-... in .env. If $ARGUMENTS contains an API key, use it.
Also set LLM_PRIMARY_API_TYPE=openai and DEFAULT_LLM_MODEL=gpt-5-nano in
.env: .env.example ships Gemini values for both, but builds call OpenAI only,
and the runtime would send gemini-2.0-flash to OpenAI.
2. Python + Repo Dependencies
python -m venv .venv
# Activate: .\.venv\Scripts\Activate.ps1 (Windows) or source .venv/bin/activate (Unix)
python -m pip install --upgrade pip
python -m pip install -e ".[dev]"
3. Frontend Dependencies
npm --prefix web_shell install
4. Start the Default Local Dev Stack
Preferred path in this repo:
.\scripts\run-studio.ps1
That starts the Studio host backend and the web_shell frontend together.
5. Verify
- Open
http://localhost:3000/apps - Check backend health at
http://localhost:8000/health - Run
.\scripts\smoke-studio-local.ps1for the full local Studio smoke - Confirm the frontend is loading the first-party builder/reference app bundle
from
factory_app/app
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +3 lines ab52fce464a5
- 2mo ago First seen · 111 lines · 25 tokens per session scan A 4b3636eeba92
setup is a skill published in the GitHub repository BlocUnited-LLC/mozaiks (24 stars, last pushed yesterday), licensed MIT. It adds 25 tokens to every session and 914 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
setup compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| setupBlocUnited-LLC/mozaiks | Skill | 24 | yesterday | MIT | A | 25 | Claude Code |
| building-pydantic-ai-agentspydantic/pydantic-ai | Skill | 21k | yesterday | MIT | A | 92 | Claude Code, Codex |
| pydantic-ai-harnesspydantic/pydantic-ai | Skill | 21k | yesterday | MIT | A | 197 | Claude Code, Codex |
| migrating-langchain-to-pydantic-aipydantic/pydantic-ai | Skill | 21k | yesterday | MIT | A | 100 | Codex |
| migrating-vercel-ai-sdk-and-eve-to-pydantic-aipydantic/pydantic-ai | Skill | 21k | yesterday | MIT | A | 107 | Codex |
| migrating-claude-agent-sdk-to-pydantic-aipydantic/pydantic-ai | Skill | 21k | yesterday | MIT | A | 90 | Codex |
| migrating-mastra-to-pydantic-aipydantic/pydantic-ai | Skill | 21k | yesterday | MIT | A | 73 | Codex |