Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/finom/vovknpx agentmods add skills/finom/vovk/baseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/finom/vovk/base)<a href="https://agentmods.dev/skills/finom/vovk/base"><img src="https://agentmods.dev/badge/skills/finom/vovk/base/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/finom/vovk/base"><img src="https://agentmods.dev/badge/skills/finom/vovk/base.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Tool Misuse · line 19 Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.Fix: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00123 | $0.03666 |
| Opus 5.5 | $0.00049 | $0.01466 |
| Sonnet 5.5 | $0.00025 | $0.00733 |
| Haiku 4.5 | $0.00012 | $0.00367 |
Grade A, and why
base scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 190 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vovk.ts essentials
What a typical API build needs. Every fact here matches vovk 4.1's code: don't read node_modules/vovk* to check it (version, exports, CLI), and don't WebFetch vovk.dev. If something is missing, say so. The installed version is the vovk entry in package.json (require('vovk/package.json') throws: the file isn't exported); the vovk bin is in node_modules/.bin.
Deeper topics, one skill each: procedure (.fn(), content types, uploads, downloads, server actions), decorators (auth, meta, stacking), segment (several or static segments), rpc (client options, fetcher), openapi (@operation, Scalar), jsonlines (streaming), tools (AI tools, MCP), config, init, bundle, mixins, multitenant, python, rust.
What vovk exports
- Values:
procedure,initSegment,get,post,put,patch,del,head,options,prefix,operation,createDecorator,HttpException,HttpStatus,HttpMethod,JSONLinesResponder,progressive,toDownloadResponse,controllersToStaticParams,multitenant,deriveTools,ToModelOutput,cloneControllerMetadata. - Types:
VovkRequest,VovkBody,VovkQuery,VovkParams,VovkInput,VovkOutput,VovkIteration,VovkReturnType,VovkYieldType,VovkConfig,VovkSchema, and a few more for tools and streams. - Other entry points:
vovk/fetcher(fetcher,createFetcher),vovk/create-rpc,vovk/create-validate-on-client.
Rules
- Node.js 24.15+, Next.js 15+ App Router, TypeScript 5.5+.
- Commit
.vovk-schema/; the generated client dir (src/client) is gitignored and rebuilt byprebuild.
Layout
- Segment:
src/app/api/[[...vovk]]/route.tsserves/api/*. Create it once withnpx vovk new segment. - Module:
src/modules/<name>/<name>-controller.tsand<name>-service.ts.npx vovk new controller service <name> --emptywrites both and adds the controller toroute.ts; writing them yourself and adding the controller tocontrollersworks the same.<name>is camelCase (userProfile). - Controller: static procedures with HTTP decorators. A procedure reads the validated input and calls the service.
- Service: business logic and data, plain typed arguments, never
req.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +2 lines 287737c51778
- 5d ago Changed · +159 lines · -19 tokens per session 785046ef6eb6
- 6d ago Changed f70b69122161
- 10d ago Changed 28c883e43636
- 11d ago Changed 2fe02b339ef3
- 12d ago Changed 94900eb97f32
- 17d ago Changed 8ac9a5a280bd
- 1mo ago First seen · 29 lines · 142 tokens per session scan A 1dc4bb398679
base is a skill published in the GitHub repository finom/vovk (53 stars, last pushed 2d ago), licensed MIT. It adds 123 tokens to every session and 3,666 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
client-setup
Create a vanilla tRPC client with createTRPCClient (), configure link chain with httpBatchLink/httpLink, dynamic headers for auth, transformer on links (not client constructor). Infer types with inferRouterInputs and inferRouterOutputs. AbortController signal support. TRPCClientError typing.
adapter-express
Mount tRPC as Express middleware with createExpressMiddleware() from @trpc/server/adapters/express. Access Express req/res in createContext via CreateExpressContextOptions. Mount at a path prefix like app.use('/trpc', ...). Avoid global express.json() conflicting with tRPC body parsing for FormData.
trpc-router
Entry point for all tRPC skills. Decision tree routing by task: initTRPC.create(), t.router(), t.procedure, createTRPCClient, adapters, subscriptions, React Query, Next.js, links, middleware, validators, error handling, caching, FormData.
nestjs
Use when building or structuring a NestJS backend — feature modules, providers and DI wiring, provider scopes and request-lifecycle order, where to bind guards/pipes/interceptors/filters, and testing with Test.createTestingModule. NOT a bare Express/Fastify service with no DI (that is nodejs), NOT framework-agnostic…
ocli-api
Turn any OpenAPI, Swagger, or OpenRPC API into CLI commands and call them. Search endpoints with BM25, check parameters, execute — no MCP server needed.
webiny-api-cms-custom-field-type
How to implement a custom CMS field type that integrates with the model builder's fluent API. Covers extending DataFieldBuilder, composing validator interfaces, creating a FieldTypeFactory, registering via DI, and module augmentation for TypeScript autocomplete on the fields() registry.