Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/evandersondev/darto/darto-validate-requestnpx skills add evandersondev/darto --skill darto-validate-requestgit clone --depth 1 https://github.com/evandersondev/dartoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evandersondev/darto/darto-validate-request)<a href="https://agentmods.dev/skills/evandersondev/darto/darto-validate-request"><img src="https://agentmods.dev/badge/skills/evandersondev/darto/darto-validate-request.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00083 | $0.01166 |
| Opus 5 | $0.00042 | $0.00583 |
| Sonnet 5 | $0.00017 | $0.00233 |
| Haiku 4.5 | $0.00008 | $0.00117 |
Grade A, and why
darto-validate-request scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Validate a request in Darto
Validation in Darto is a route middleware, zValidator, from the
darto_validator package. It validates one part of the request against a
zard schema (Zod-style). When validation
passes, the handler runs and reads the parsed data via c.req.valid(...). When
it fails, the request is rejected before the handler runs.
Setup
# pubspec.yaml
dependencies:
darto: ^1.2.0
darto_validator: ^1.0.0 # re-exports `zard`; no separate zard dependency
import 'package:darto/darto.dart';
import 'package:darto_validator/darto_validator.dart'; // gives you z.* and zValidator
Procedure
- Define a schema with
z:final userSchema = z.map({ 'name': z.string().min(1), 'email': z.string().email(), 'age': z.int().min(0).max(150), }); - Attach
zValidator(target, schema)as route middleware. The handler runs only if validation succeeds:app.post('/users', [zValidator('json', userSchema)], (Context c) { final data = c.req.valid<Map<String, dynamic>>('json'); return c.created({'user': data}); }); - Read the validated data in the handler with the same target string:
c.req.valid<Map<String, dynamic>>('json' | 'query' | 'param' | 'header'). Use the validated value — not the rawc.req.json()— so you get the parsed / coerced result.
Targets
target |
Validates |
|---|---|
'json' |
JSON request body |
'query' |
query-string parameters |
'param' |
path parameters |
'header' |
request headers |
// Query
app.get('/search', [zValidator('query', z.map({'q': z.string().min(1)}))], (c) {
final q = c.req.valid<Map<String, dynamic>>('query');
return c.ok({'query': q['q']});
});
// Path param
app.get('/posts/:id', [zValidator('param', z.map({'id': z.string()}))], (c) {
final params = c.req.valid<Map<String, dynamic>>('param');
return c.ok({'id': params['id']});
});
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 136 lines · 83 tokens per session scan A 7fea89542714
darto-validate-request is a skill published in the GitHub repository evandersondev/darto (43 stars, last pushed 1mo ago), licensed MIT. It adds 83 tokens to every session and 1,166 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Express/Fastify Backend Patterns
Use this skill when building Node.js HTTP APIs with Express or Fastify and you want safe request validation, predictable error handling, and maintainable routing/service layering.
backend
Backend development with Node.js, Express, NestJS, and server patterns.
horse-database-pooling
Guide for setting up thread-safe database connection pooling (FireDAC / UniDAC) in multithreaded Horse applications.
horse-mvc-architecture
Guide for structuring corporate Horse applications using Clean MVC (Model-View-Controller) principles and decoupling HTTP layers from business logic.
horse-request-response
Guide to interacting with THorseRequest (body, query, params, headers) and THorseResponse (Send, Status, ContentType).
horse-grpc
Guidelines and workflows for developing and maintaining gRPC services, HTTP/2 h2c transport, and Protobuf serialization within the Horse framework.