Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fusebase-dev/fusebase-flow/api-explorationnpx skills add fusebase-dev/fusebase-flow --skill api-explorationgit clone --depth 1 https://github.com/fusebase-dev/fusebase-flowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00079 | $0.00762 |
| Opus 5 | $0.00039 | $0.00381 |
| Sonnet 5 | $0.00016 | $0.00152 |
| Haiku 4.5 | $0.00008 | $0.00076 |
Grade A, and why
api-exploration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Exploration with Temporary Tokens
When you're unsure about an API endpoint's behavior, response shape, or want to test a flow before committing to implementation — create a temporary token and run test calls directly.
Workflow
1. Create a temporary token
fusebase token create --app <appId>
This outputs a short-lived token (15 min) to stdout. Capture it:
TOKEN=$(fusebase token create --app <appId>)
The appId comes from fusebase.json → apps[].id.
2. Write and run test code
Create a temporary script (e.g. _test-api.ts) to make the API calls you want to verify:
const token = process.env.TOKEN || "<paste-token-here>";
const res = await fetch("https://api-endpoint/...", {
headers: { "x-app-feature-token": token },
});
console.log(res.status);
console.log(await res.json());
Run it:
TOKEN=$(fusebase token create --app <appId>) bun _test-api.ts
3. Inspect results and iterate
Read the output, adjust your calls, and re-run. Once you understand the API behavior, implement it properly in your app code.
4. Clean up
Delete the temporary test script when done — don't commit it.
Example: Testing @fusebase/dashboard-service-sdk
Use this to verify SDK calls before wiring them into app UI code.
_test-sdk.ts:
import {
createClient,
DatabasesApi,
CustomDashboardRowsApi,
} from "@fusebase/dashboard-service-sdk";
const token = process.env.TOKEN!;
const BASE_URL =
"https://app-api.{FUSEBASE_HOST}/v4/api/proxy/dashboard-service/v1";
const client = createClient({
baseUrl: BASE_URL,
defaultHeaders: { "x-app-feature-token": token },
});
const dbApi = new DatabasesApi(client);
const rowsApi = new CustomDashboardRowsApi(client);
// List databases visible to this app
const dbs = await dbApi.listDatabases({});
console.log("databases:", JSON.stringify(dbs, null, 2));
// Read rows from a specific dashboard view
const rows = await rowsApi.getRows({
dashboardId: "<dashboardId>",
viewId: "<viewId>",
});
console.log("rows:", JSON.stringify(rows, null, 2));
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 105 lines · 79 tokens per session scan A a19b1397bc0b
api-exploration is a skill published in the GitHub repository fusebase-dev/fusebase-flow (9 stars, last pushed 6d ago), licensed MIT. It adds 79 tokens to every session and 762 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
adobe-express-core
Adobe Express environment essentials, two-runtime architecture, project setup, and MCP server configuration. Use when starting add-on development, understanding iframe vs sandbox boundaries, configuring MCP servers, setting up local projects, or validating manifest configuration.
adobe-express-monetization
Monetize Adobe Express add-ons with subscriptions and payments. Use when designing checkout flows, defining subscription tiers, implementing webhook verification, managing entitlements, or securing backend billing logic.
adobe-express-spectrum-ui-ux
Build or review Adobe Express add-on panel UI with Spectrum patterns, stack selection guidance (raw SWC, swc-react, React Spectrum), Express theme setup, state and navigation design, and actionable UX quality checks. Use when implementing or auditing panel layouts, interaction states, multi-screen flows, and…
adobe-express-cors-and-backend
Diagnose and fix CORS errors between Adobe Express add-on UI and backend APIs across local development, private listing, and public listing stages. Use when browser requests fail with preflight, Access-Control-Allow-Origin, Access-Control-Allow-Headers, or OPTIONS issues; when moving from localhost to hosted add-on…
adobe-express-document-manipulation
Create and modify document content in Adobe Express add-ons using Document SDK. Use when planning document operations, inserting shapes/text/media, sequencing sandbox commands, or troubleshooting document edits.
adobe-express-oauth-authentication
Implement OAuth 2.0 and authentication flows for Adobe Express add-ons. Use when connecting to cloud providers (Dropbox, OneDrive, Google Drive), managing tokens, storing credentials, or designing login surfaces.