Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/geekfujiwara/codeappsdevelopmentstandard/package-samplenpx skills add geekfujiwara/CodeAppsDevelopmentStandard --skill package-samplegit clone --depth 1 https://github.com/geekfujiwara/CodeAppsDevelopmentStandardWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00106 | $0.03330 |
| Opus 5 | $0.00053 | $0.01665 |
| Sonnet 5 | $0.00021 | $0.00666 |
| Haiku 4.5 | $0.00011 | $0.00333 |
Grade A, and why
package-sample scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 293 lines — stays where its author put it; the contents beside it link to each section on GitHub.
サンプルソリューション パッケージングスキル
Code Apps サンプルを世界中の開発者が再利用・カスタマイズできる形に仕上げる。 実行すると以下の 5 フェーズを順に処理する。
[!NOTE] このスキルは
samples/{sample-name}/ディレクトリに対して実行する。 対象サンプルが指定されていない場合はユーザーに確認すること。
フェーズ 1: セキュリティスキャン・修正
1-1. 検出対象
以下のパターンをコード・設定ファイル全体から検出する。
| カテゴリ | 検出パターン | 対処 |
|---|---|---|
| テナント ID | 32桁 GUID（xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 形式の実値） |
{your-tenant-id} に置換 |
| 環境 ID | 同上 | {your-environment-id} に置換 |
| Dataverse URL | https://[a-z0-9]+\.crm[0-9]*\.dynamics\.com 形式の実 URL |
https://{org}.crm.dynamics.com/ に置換 |
| Bot ID / Schema | 実 GUID、実スキーマ名（xxx_yyy 形式で明らかに固有のもの） |
{your-bot-id} / {your-bot-schema} に置換 |
| フロー Workflow ID | GUID 形式の実値 | {your-flow-workflow-id} に置換 |
| 接続 ID / CONNREF | 実接続 ID 文字列 | {your-connection-id} に置換 |
| メールアドレス | @ を含む実アドレス（example.com 以外） |
[email protected] に置換 |
| PAC 認証プロファイル名 | 実プロファイル名 | {YourProfileName} に置換 |
1-2. コード内ハードコードチェック
検出: テーブル名の直書き
- NG: "geek_customers" / "myco_records" 等の実プレフィックス文字列
- OK: `${P}_customers` / `${PUBLISHER_PREFIX}_records`
【重要な例外】OData バインド文字列はそのままでよい:
- OK（変更不要）: "[email protected]"
これは Dataverse の API ペイロード形式であり、型定義のフィールド名と連動するため
動的化しても型安全性が失われるだけ。プレフィックス変更時はここも手動置換。
検出: システムテーブル vs カスタムテーブルの区別
- システムテーブル（プレフィックス不要）: bots / conversationtranscripts / systemusers
- カスタムテーブル（プレフィックス必要）: {prefix}_customers / {prefix}_conversationsummaries 等
→ Copilot Analytics 用テーブルも `{prefix}_conversationsummaries` のようにカスタムテーブルなので動的化必須
検出: VITE_ 変数への秘匿情報混入
- NG: VITE_API_SECRET / VITE_TOKEN 等
- VITE_ 変数はビルド成果物に平文で含まれる（ブラウザから参照可能）
検出: .env / power.config.json のコミット漏れ
- ルートの .gitignore に .env / power.config.json / .power/ / src/generated/ が含まれているか確認
- ルート .gitignore はリポジトリ全体に適用されるため、サンプル個別の .gitignore は不要
1-3. スキャン手順
スキャンは scripts/scan_sample.py で機械的に実行する（手作業の grep は残さない）。
実 GUID・実 Dataverse URL・実メール・クライアントシークレット・テーブル名直書き・
VITE_ への秘匿混入・.gitignore 必須エントリを一括で検出する。
python .github/skills/package-sample/scripts/scan_sample.py .github/skills/code-apps/samples/{sample-name}
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 293 lines · 106 tokens per session scan A 173f12308df1
package-sample is a skill published in the GitHub repository geekfujiwara/CodeAppsDevelopmentStandard (59 stars, last pushed 4d ago), licensed MIT. It adds 106 tokens to every session and 3,330 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vertex-deploy
Skill "vertex-deploy" from GoogleCloudPlatform/vertex-ai-samples, covering vertex ai model garden deploy skill, 1. prerequisites, 2. discovering deployable models, 3. deploying a model and example: deploying gemma 3.
vertex-inference
Skill "vertex-inference" from GoogleCloudPlatform/vertex-ai-samples, covering vertex ai genai inference skill, 1. authentication (critical), 2. gemini models, choosing the right sdk and installation.
genai-sdk
Guides the usage of Gemini API on Google Cloud Vertex AI with the Gen AI SDK. Use when the user asks about using Gemini in an enterprise environment or explicitly mentions Vertex AI. Covers SDK usage (Python, JS/TS, Go, Java, C#), capabilities like Live API, tools, multimedia generation, caching, and batch prediction.
quality-flywheel
Evaluate and improve GenAI models and agents using the Google GenAI Evaluation SDK. Creates eval datasets (from session traces or synthetic generation), selects and configures metrics (RubricMetric, LLMMetric, CodeExecutionMetric), executes evals via client.evals.evaluate(), and analyzes results to suggest concrete…
gemini
Skill "gemini" from GoogleCloudPlatform/vertex-ai-samples, covering vertex ai gemini model tuning, workflow decision tree, phase 0: environment & iam setup {#phase-0}, 0.1 authentication & project context and 0.2 enable apis.
open-model
Skill "open-model" from GoogleCloudPlatform/vertex-ai-samples, covering vertex ai open model tuning, workflow decision tree, phase 0: environment & iam setup {#phase-0}, 0.1 authentication & project context and 0.2 possible locations.