Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add evandersondev/darto --skill darto-add-routegit clone --depth 1 https://github.com/evandersondev/dartoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evandersondev/darto/darto-add-route)<a href="https://agentmods.dev/skills/evandersondev/darto/darto-add-route"><img src="https://agentmods.dev/badge/skills/evandersondev/darto/darto-add-route/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/evandersondev/darto/darto-add-route"><img src="https://agentmods.dev/badge/skills/evandersondev/darto/darto-add-route.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.01237 |
| Opus 5 | $0.00045 | $0.00619 |
| Sonnet 5 | $0.00018 | $0.00247 |
| Haiku 4.5 | $0.00009 | $0.00124 |
Grade A, and why
darto-add-route scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Add a route to a Darto app
Darto is a pure-Dart web framework with a Hono-style single Context model.
A handler receives one Context c and returns a Response. It is not
Express: there is no (req, res, next), no res.send().
The contract
typedef Handler = FutureOr<Response>? Function(Context c);
typedef Middleware = FutureOr<void> Function(Context c, Next next);
typedef Next = Future<void> Function();
Procedure
- Import the core library (only this for routing):
import 'package:darto/darto.dart'; - Register the route. Every verb method takes three arguments:
app.verb(path, [middlewares], handler). The middleware list is required — pass[]when there is none.
Verbs:app.get('/users/:id', [], (Context c) { final id = c.req.param('id'); return c.ok({'id': id}); });get post put patch delete head options all. For custom or multiple verbs/paths:app.on(['GET','POST'], ['/a','/b'], [], handler). - Read the request through
c.req(never a separate request arg):- Params:
c.req.param('id'),c.req.paramInt('id'),c.req.paramDouble('id') - Query:
c.req.query('page'),c.req.queryInt,c.req.queryBool(true/1/yes/on) - Headers:
c.req.header('authorization') - Body:
await c.req.json()→Map, or typedawait c.req.json<User>(User.fromJson); alsoc.req.text(),c.req.blob()(Uint8List). - URL info:
c.req.method,c.req.path,c.req.url,c.req.ip
- Params:
- Return a response — always
returna helper, don't "send":- Status helpers:
c.ok(200),c.created(201),c.noContent(204),c.badRequest(400),c.unauthorized(401),c.forbidden(403),c.notFound(404),c.conflict(409),c.internalError(500). - Typed:
c.json(data, [status]),c.text(str, [status]),c.html(str, [status]). - Custom:
c.status(206).json(data). Headers:c.header('X-Id', v). - Files/redirect:
c.binary(bytes, contentType: ...),await c.file(path),await c.download(path, filename: ...),c.redirect('/path', [301]).
- Status helpers:
- Listen (once, at the bottom of
main):app.listen(3000);
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 120 lines · 90 tokens per session scan A 56678c434578
darto-add-route is a skill published in the GitHub repository evandersondev/darto (43 stars, last pushed 2mo ago), licensed MIT. It adds 90 tokens to every session and 1,237 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
horse-lazarus-compatibility
Guide for ensuring Lazarus and Free Pascal (FPC) compatibility, addressing anonymous methods differences, JSON units, and compiler directives.
Express/Fastify Backend Patterns
Use this skill when building Node.js HTTP APIs with Express or Fastify and you want safe request validation, predictable error handling, and maintainable routing/service layering.
backend
Backend development with Node.js, Express, NestJS, and server patterns.
client-setup
Create a vanilla tRPC client with createTRPCClient (), configure link chain with httpBatchLink/httpLink, dynamic headers for auth, transformer on links (not client constructor). Infer types with inferRouterInputs and inferRouterOutputs. AbortController signal support. TRPCClientError typing.
adapter-express
Mount tRPC as Express middleware with createExpressMiddleware() from @trpc/server/adapters/express. Access Express req/res in createContext via CreateExpressContextOptions. Mount at a path prefix like app.use('/trpc', ...). Avoid global express.json() conflicting with tRPC body parsing for FormData.
trpc-router
Entry point for all tRPC skills. Decision tree routing by task: initTRPC.create(), t.router(), t.procedure, createTRPCClient, adapters, subscriptions, React Query, Next.js, links, middleware, validators, error handling, caching, FormData.