Borrowing it
Nothing to install: this file belongs to burnjohn/quick-blog. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/burnjohn/quick-blog/main/.claude/skills/express-best-practices/SKILL.mdgit clone --depth 1 https://github.com/burnjohn/quick-blogWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/burnjohn/quick-blog/express-best-practices)<a href="https://agentmods.dev/skills/burnjohn/quick-blog/express-best-practices"><img src="https://agentmods.dev/badge/skills/burnjohn/quick-blog/express-best-practices.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.02009 |
| Opus 5 | $0.00030 | $0.01005 |
| Sonnet 5 | $0.00012 | $0.00402 |
| Haiku 4.5 | $0.00006 | $0.00201 |
Grade A, and why
express-best-practices scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
The source is not reproduced here
No licence file
A repository with no LICENSE is all rights reserved by default, so the body is not copied here. The metadata, the measurements and the link are.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 190 lines · 59 tokens per session scan A 167cd2e5442b
express-best-practices is a skill published in the GitHub repository burnjohn/quick-blog (23 stars, last pushed 2mo ago), with no licence file. It adds 59 tokens to every session and 2,009 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dynamic
Fullstack development with bkend.ai BaaS — authentication, database, API integration. Triggers: fullstack, BaaS, login, signup, database, web app.
ring:mapping-service-resources
Mapping a Go service's Service -> Module -> Resource hierarchy for dispatch-layer registration: detects modules and per-module PostgreSQL/MongoDB/RabbitMQ resources, database names, and shared databases, generates MongoDB index migration pairs (.up.json/.down.json), detects existing Postgres migrations, emits an HTML…
fastapi-init-skill
FastAPI 项目一键初始化技能。面向零基础小白，提供环境探测、自动安装、完整 Web 骨架生成、SSE 流式框架、JWT 鉴权、统一响应封装、文件上传接口、一键启动/重启脚本、Swagger 文档，内置 MySQL（默认）/ PostgreSQL / MongoDB 数据库选择。用户只需说"帮我搭一个 FastAPI 项目"即可一条命令完成从零到跑的完整链路。触发词："FastAPI 脚手架"、"FastAPI 一键生成"、"初始化 FastAPI 项目"、"FastAPI 快速开始"、"fastapi init"、"搭建 FastAPI 服务"、"Python Web 骨架"、"FastAPI 开箱即用"、"FastAPI…
nodejs-init-skill
Node.js + Express 项目一键初始化技能。面向零基础小白，提供环境探测、自动安装、完整 Web 骨架生成、JWT 鉴权、统一响应封装、文件上传接口、一键启动/重启脚本、Swagger 文档，内置 MongoDB（默认）/ MySQL / PostgreSQL 数据库选择。用户只需说"帮我搭一个 Node.js 项目"即可一条命令完成从零到跑的完整链路。触发词："Node.js 脚手架"、"Node.js 一键生成"、"初始化 Node.js 项目"、"Node.js 快速开始"、"nodejs init"、"搭建 Express 服务"、"Express Web 骨架"、"Express 开箱即用"、"Node.js…
mongodb-development
MongoDB development guidelines with Payload CMS, Mongoose, aggregation pipelines, and TypeScript best practices.
nest-data-layer
ORM patterns for NestJS: TypeORM, Prisma, Mongoose. Covers entities, repositories, transactions, migrations, common pitfalls (N+1, cascade deletes, transaction boundaries). Use this skill to: Detect which ORM the project uses and apply matching patterns. Define entities/schemas with the right decorators. Inject…