Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gul-labs/craftsman-marketplace --skill craft-backendgit clone --depth 1 https://github.com/gul-labs/craftsman-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gul-labs/craftsman-marketplace/craft-backend)<a href="https://agentmods.dev/skills/gul-labs/craftsman-marketplace/craft-backend"><img src="https://agentmods.dev/badge/skills/gul-labs/craftsman-marketplace/craft-backend/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gul-labs/craftsman-marketplace/craft-backend"><img src="https://agentmods.dev/badge/skills/gul-labs/craftsman-marketplace/craft-backend.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00138 | $0.02704 |
| Opus 5 | $0.00069 | $0.01352 |
| Sonnet 5 | $0.00028 | $0.00541 |
| Haiku 4.5 | $0.00014 | $0.00270 |
Grade A, and why
craft-backend scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 184 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Backend Craft
This skill encodes one engineer's standard for building reliable, secure backend code, applied the same way across every repo. The method and opinions live here; the specifics (which framework, which ORM, which auth provider, which error envelope shape) are discovered from the target repo — never hardcoded, never assumed.
Operating principle — discover before you build
Every repo already has conventions. Spend two minutes reading what exists so you extend the patterns rather than introduce a second style:
package.json/ lockfile → what framework is in use (Next.js API routes, Express, Fastify, NestJS, Hono)?- Grep for an existing route handler, a validation call, and an error-response helper — understand the shape before adding to it.
- Grep for the auth layer (Clerk, NextAuth, JWT middleware, session cookie) and find where tenant or user context is resolved.
- Find the error-response helper or the established error envelope — every new route should return the same shape.
State what you found, then propose the smallest set of additions that fits cleanly into those patterns.
The request lifecycle (build in this order)
-
Auth & context — authenticate the caller and resolve tenant/user context before touching anything else. A request that isn't authenticated or can't be scoped to the right tenant must be rejected immediately, not after a DB round-trip. See
references/auth.md.auth.mdowns authN/context only — authorization is a separate, blocking obligation (next paragraph).Required-load gate (authZ is cross-domain).
craft-backendowns the request-lifecycle plumbing; it does not own the authorization invariants. Any task that adds, secures, or reviews an endpoint is not complete until you have loaded and appliedcraft-security→authz.md(per-resource authZ, IDOR/tenant scoping, JWT verification, deny-by-default) andcraft-db→access-patterns.md(tenant-scoped query helper). These are mandatory at the auth boundary, not optional cross-links — the single most expensive place to let a gap through.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 184 lines · 138 tokens per session scan A 87af2d4fbfdc
craft-backend is a skill published in the GitHub repository gul-labs/craftsman-marketplace (1 stars, last pushed today), licensed MIT. It adds 138 tokens to every session and 2,704 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
api-audit
API and endpoint integrity audit across 10 dimensions (D1-D10) plus optional contract stability (D11) and optional OWASP API Security Top 10 (D12: BOLA/BOPLA/BFLA, mass assignment, JWT alg-confusion, GraphQL introspection). Covers validation, payloads, pagination, errors, caching, HTTP semantics, waterfalls, rate…
performance-audit
Full-stack performance health check across 12 dimensions. Rendering, bundles, assets, API/network, algorithms, memory, database, caching, Web Vitals, backend runtime, concurrency, and framework-specific pathologies. Evidence-based Impact Models with confidence tiers and a prioritized optimization roadmap. Switches…
plumb-line-audit
Use when auditing a diff or repository against the plumb-line principles — finds laundered uncertainty, boundary leaks, hardcoded priors, overstated maturity, outputs lacking recorded lineage, and baseline drift with no explanation. Read-only: it reports, never auto-fixes.
breaking-change-detector
Use this skill to help API producers and consumers find actual or potential breaking changes — REST/OpenAPI, GraphQL, gRPC/Protobuf, or consumer-driven contracts — and apply SemVer and deprecation discipline. Trigger on "will this change break our API consumers", "how do I detect breaking changes in our OpenAPI spec"…
explain-back
Use before trusting, merging, or building on top of code you (or an agent) just wrote or are about to change. The agent explains the code back in plain language — what it does, why it exists, what breaks if it's wrong — and refuses to proceed until the mental model is confirmed. Use when a diff looks fine but nobody…
prove-every-number
Use whenever code contains a numeric constant, threshold, default, rate, capacity, tolerance, or coefficient — especially one the agent just introduced. Enforces the rule: every number is either derived (from real data or first principles, traceably) or cited (to a spec, datasheet, standard, or documented decision) …