Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add finom/vovk --skill initgit clone --depth 1 https://github.com/finom/vovkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/finom/vovk/init)<a href="https://agentmods.dev/skills/finom/vovk/init"><img src="https://agentmods.dev/badge/skills/finom/vovk/init/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/finom/vovk/init"><img src="https://agentmods.dev/badge/skills/finom/vovk/init.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 39 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 48 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 74 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 157 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 173 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 174 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 175 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00334 | $0.03181 |
| Opus 5.5 | $0.00134 | $0.01272 |
| Sonnet 5.5 | $0.00067 | $0.00636 |
| Haiku 4.5 | $0.00033 | $0.00318 |
Grade A, and why
init scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 174 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vovk.ts initialization
Vovk.ts is TypeScript-first RPC/API framework plugging into Next.js App Router. Ships CLI (vovk-cli) that installs deps, toggles experimentalDecorators in tsconfig, wires up npm scripts, writes vovk.config.mjs. Coordinated edits easy to get wrong by hand, so this skill is thin wrapper: preps env, delegates to CLI, handles follow-ups.
Plugin is source of truth for everything Vovk-related — don't WebFetch vovk.dev while running this skill. If step here looks incomplete, that's skill bug, surface it.
Interactive prompts
vovk-cli and create-next-app both interactive. When prompt appears skill doesn't cover, accept default (usually "yes" or CLI's recommended choice) unless user told you otherwise. Don't predict every prompt up front — defaults change, user can override afterward.
Decide the path
Inspect current working dir:
package.jsonexists withnextindependenciesordevDependencies→ Path A (existing Next.js project).- Otherwise → Path B (new project).
If package.json exists but no next, it's existing non-Next.js project. Ask whether to add Next.js into current dir or scaffold new one in subdir — don't silently pollute their repo.
Path A — existing Next.js project
1. Verify prerequisites (bundled)
Check all three in parallel:
- Node version:
node --version— require ≥ 24.15 (Bun 1.4+ and Deno 2.9+ also runvovk-cli). - Next.js version:
package.jsonnextmust resolve to ≥ 15.0.0. - App Router directory:
src/app/orapp/must exist (even if empty) — Vovk mounts route handler there. If onlypages/exists, trivial fix: create emptyapp/(orsrc/app/, matching project's convention) alongside. App Router and Pages Router coexist fine — no migration needed just to use Vovk.
If any check fails, bundle all failures into one message and ask user how to proceed. Don't drip-feed one at a time. Example:
"Two blockers before Vovk can run:
- Node is on v20.18.0 — Vovk needs ≥ 24.15. You'll need to upgrade it yourself (
nvm install 24 && nvm use 24or equivalent); I won't touch your Node install.- Next.js is on
^14.2.5— I can runnpx @next/codemod@canary upgrade latestto move to 15. It can introduce breaking changes, so reviewing the diff afterward is a good idea.Also: no
app/directory yet — I'll create an emptysrc/app/alongsidepages/so Vovk has somewhere to mount. That coexists with your existing Pages Router fine.Want me to proceed after you bump Node?"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed 4532093ec538
- 5d ago Changed · +29 tokens per session 945eadb097a1
- 12d ago Changed · +2 tokens per session 877169504f71
- 16d ago Changed · +1 tokens per session b665952c5c1c
- 17d ago Changed 415ec1ac3951
- 18d ago Changed a1e5f9a3c595
- 23d ago Changed · -41 lines 22b23ddaddab
- 1mo ago First seen · 215 lines · 302 tokens per session scan A 927df9e7d61c
init is a skill published in the GitHub repository finom/vovk (54 stars, last pushed 2d ago), licensed MIT. It adds 334 tokens to every session and 3,181 once invoked, about $0.0013 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
client-setup
Create a vanilla tRPC client with createTRPCClient (), configure link chain with httpBatchLink/httpLink, dynamic headers for auth, transformer on links (not client constructor). Infer types with inferRouterInputs and inferRouterOutputs. AbortController signal support. TRPCClientError typing.
trpc-router
Entry point for all tRPC skills. Decision tree routing by task: initTRPC.create(), t.router(), t.procedure, createTRPCClient, adapters, subscriptions, React Query, Next.js, links, middleware, validators, error handling, caching, FormData.
adapter-express
Mount tRPC as Express middleware with createExpressMiddleware() from @trpc/server/adapters/express. Access Express req/res in createContext via CreateExpressContextOptions. Mount at a path prefix like app.use('/trpc', ...). Avoid global express.json() conflicting with tRPC body parsing for FormData.
pinme-email
Use this skill when a PinMe project (Worker TypeScript) needs to integrate email sending (sendemail). Guides AI to generate correct Worker TS code.
node-modern
Use this skill when writing, reviewing, or refactoring Node.js code — modules, async flow, cancellation, file and process I/O, HTTP — on a current Node.js release. Triggers: user mentions "Node", "Node.js", "ESM", "CommonJS", "require", "import", "fetch", "AbortSignal", "AbortController", "stream", "childprocess"…
nestjs
Use when building or structuring a NestJS backend — feature modules, providers and DI wiring, provider scopes and request-lifecycle order, where to bind guards/pipes/interceptors/filters, and testing with Test.createTestingModule. NOT a bare Express/Fastify service with no DI (that is nodejs), NOT framework-agnostic…