Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dkadts/landing-kit-building/deploynpx skills add dkadts/landing-kit-building --skill deploygit clone --depth 1 https://github.com/dkadts/landing-kit-buildingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dkadts/landing-kit-building/deploy)<a href="https://agentmods.dev/skills/dkadts/landing-kit-building/deploy"><img src="https://agentmods.dev/badge/skills/dkadts/landing-kit-building/deploy.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00045 | $0.01999 |
| Opus 5 | $0.00023 | $0.01000 |
| Sonnet 5 | $0.00009 | $0.00400 |
| Haiku 4.5 | $0.00005 | $0.00200 |
Grade A, and why
deploy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 219 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/deploy
Final step. Publishes the landing to production. DOES NOT RUN if /audit did not pass.
When to use
- After
/auditwith pass verdict. - Updates to an already-deployed landing (then the gate is only audit).
Requirements — HARD BLOCKING
site/_audit-report.mdexists with verdict = OK.- No uncommitted changes in git (user commits themselves — CLAUDE.md rule 5).
vercel.jsonpresent.- All env vars from
brief/06-technical.mdare configured wherever the user chose to store them (Vercel Dashboard, or Google Cloud Secret Manager — see Step 3a).
Process
Step 1. Verify readiness
- Read
site/_audit-report.md, verdict must be OK. - Read
brief/06-technical.md— domain, region, env vars. - Read
brief/blocks/contact-form.md— which backend (affects env vars).
Step 2. First deploy vs update
If first deploy:
- User installs Vercel CLI:
npm i -g vercel. - Init:
vercel(asks project, domain, etc.). - Configure secret storage (Step 3a).
- Configure env vars (Step 3b).
- Configure domain (Step 4): DNS at the registrar → Vercel.
If update:
vercel --prod(or via GitHub integration, if wired).
Step 3a. Secret storage choice
Ask the user how to store sensitive keys before writing anything to Vercel. Options:
Option A. Vercel env vars only (simplest, default)
- Secrets live in Vercel Dashboard → Settings → Environment Variables.
- Marked as "Sensitive" so they're write-only after creation.
- Trade-off: rotation is manual, audit log is Vercel Enterprise-tier, and multi-project secret sharing means duplicating values.
- Good fit for: single-landing projects, hobby projects, agencies with one client per Vercel team.
Option B. Google Cloud Secret Manager (recommended for production / multi-project)
- Secrets live in a central GCP project.
- IAM-controlled access, versioning, audit log out of the box, easy rotation.
- Vercel serverless functions read secrets at runtime via
@google-cloud/secret-managerusing a service account. - Only two values live in Vercel env vars:
GCP_PROJECT_IDandGCP_SA_KEY_JSON(base64-encoded service account key).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 219 lines · 45 tokens per session scan A a956767f5cb1
deploy is a skill published in the GitHub repository dkadts/landing-kit-building (2 stars, last pushed 16d ago), licensed MIT. It adds 45 tokens to every session and 1,999 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ultracite
Ultracite is a zero-config linting and formatting preset for JavaScript/TypeScript projects. Use when: (1) Setting up or initializing Ultracite in a project (ultracite init), (2) Running linting or formatting commands (check, fix, doctor), (3) Writing or reviewing JS/TS code in a project that uses Ultracite — to…
next-upgrade
Upgrade Next.js to the latest version following official migration guides and codemods.
vercel-deployment
Vercel deployment workflows, environment management, domain configuration, and build troubleshooting. Use when deploying, checking deployment status, reviewing build logs, or managing environments.
netlify-deployment
Deploy sites, configure serverless and edge functions, and verify builds on Netlify. Use when the user mentions: 'deploy preview', 'configure netlify.toml', or 'debug a failed deploy'. Trigger terms: build error, Netlify Functions, deploy logs, deploy preview.
regenerate-api
Regenerate the AppointMe frontend API client (orval/TanStack Query hooks + TypeScript schemas) after the backend OpenAPI surface changes. Use this whenever backend endpoints, request/response DTOs, or other contract-affecting types are added, removed, or modified — e.g. after editing files under src/AppointMe.Api…
verify
Build, launch, and drive the AppointMe stack to verify a change end-to-end at its runtime surface.