Borrowing it
Nothing to install: this file belongs to hachej/boring-ui. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/hachej/boring-ui/main/.agents/skills/boring-app-setup/SKILL.mdgit clone --depth 1 https://github.com/hachej/boring-uiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hachej/boring-ui/boring-app-setup)<a href="https://agentmods.dev/skills/hachej/boring-ui/boring-app-setup"><img src="https://agentmods.dev/badge/skills/hachej/boring-ui/boring-app-setup.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.00636 |
| Opus 5 | $0.00039 | $0.00318 |
| Sonnet 5 | $0.00016 | $0.00127 |
| Haiku 4.5 | $0.00008 | $0.00064 |
Grade A, and why
boring-app-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Boring App Setup
Use this skill as a router first. Read the relevant reference file before answering architecture, provider, or plugin-shape questions.
Default rule
Default to apps/full-app for anything that should become a real product.
Use another base only when the user clearly wants:
apps/workspace-playground— plugin/workbench prototypeapps/agent-playground— chat/agent-only app
Routing table
| Need | Read first | Then use |
|---|---|---|
| choose the child app shape | references/app-shape.md |
playbooks/EXECUTION_PLAYBOOK.md |
| map external dependencies | references/dependencies.md |
references/providers/*.md |
| choose plugin path | references/plugin-paths.md |
.agents/skills/boring-plugin-build/SKILL.md |
| decide where logic should live | references/ownership.md |
references/transport.md, references/routes.md |
| decide runtime + deploy shape | references/runtime-and-provisioning.md |
references/providers/vercel.md, references/providers/fly.md |
| decide data/migrations | references/persistence.md |
playbooks/CHECKLISTS.md, playbooks/EXECUTION_PLAYBOOK.md |
| verify readiness | references/acceptance.md |
playbooks/CHECKLISTS.md |
Provider routing
| Need | Read |
|---|---|
| managed Postgres | references/providers/postgres.md |
| mail delivery | references/providers/mail-transport.md |
sender domain / MAIL_FROM |
references/providers/sender-identity.md |
| generic hosted baseline | references/providers/vercel.md |
| our custom always-on setup | references/providers/fly.md |
| model/API provider | references/providers/model-providers.md |
Operating files
playbooks/EXECUTION_PLAYBOOK.md— phase-by-phase execution loopplaybooks/PROGRESS_DISCLOSURE.md— how to report status clearlyplaybooks/CHECKLISTS.md— creation / deploy / verification checklists
Plugin references
.agents/skills/boring-plugin-build/SKILL.mdpackages/pi/skills/boring-plugin-authoring/SKILL.mdpackages/plugin-cli/templates/plugin/README.mdpackages/cli/README.md
What ships with it
33 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- manuals/app-shape/APP_ARCHETYPES.md 2.4 KB
- manuals/app-shape/IMPLEMENTATION_SHAPE.md 1.7 KB
- manuals/architecture/OWNERSHIP_RULES.md 2.1 KB
- manuals/architecture/ROUTE_COMPOSITION.md 1.8 KB
- manuals/architecture/TRANSPORT_DECISION_MATRIX.md 1.9 KB
- manuals/archive/DETAILED_MANUAL_ARCHIVE.md 0 B
- manuals/data/PERSISTENCE_AND_MIGRATIONS.md 1.8 KB
- manuals/dependencies/EXTERNAL_DEPENDENCY_MAP.md 3.6 KB
- manuals/plugins/PLUGIN_PATHS.md 2.7 KB
- manuals/providers/MANUAL_HANDOFFS.md 2.3 KB
- manuals/providers/PROVIDER_SNIPPETS.md 8.6 KB
- manuals/README.md 691 B
- manuals/runtime/PROVISIONING_PATTERNS.md 1.5 KB
- manuals/verification/ACCEPTANCE_MATRIX.md 1.3 KB
- playbooks/CHECKLISTS.md 1.9 KB
- playbooks/EXECUTION_PLAYBOOK.md 4.1 KB
- playbooks/PROGRESS_DISCLOSURE.md 1.6 KB
- references/acceptance.md 962 B
- references/app-shape.md 1.1 KB
- references/dependencies.md 1.8 KB
- references/ownership.md 849 B
- references/persistence.md 829 B
- references/plugin-paths.md 1.8 KB
- references/providers/fly.md 723 B
- references/providers/mail-transport.md 685 B
- references/providers/model-providers.md 599 B
- references/providers/postgres.md 777 B
- references/providers/sender-identity.md 801 B
- references/providers/vercel.md 755 B
- references/README.md 633 B
- references/routes.md 916 B
- references/runtime-and-provisioning.md 876 B
- references/transport.md 838 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 60 lines · 79 tokens per session scan A d560b6e2aa24
boring-app-setup is a skill published in the GitHub repository hachej/boring-ui (46 stars, last pushed today), licensed MIT. It adds 79 tokens to every session and 636 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
cli-ux
Use for packages/cli changes that affect command UX, prompts, help, output layout, progress, success, warnings, errors, JSON/stdout/stderr contracts, non-interactive/agent behavior, copy, or tests for those surfaces. Do not load for implementation-only refactors with unchanged CLI surface.
x-lsof
Enhanced lsof (List Open Files) with interactive UI and structured output. View open files, network connections, and processes. Dependency: This is an x-cmd module. Install x-cmd first (see x-cmd skill for installation options). see x-cmd skill for installation.
x-last
Enhanced last command with CSV, JSON, tree view, and interactive UI for viewing login history. Dependency: This is an x-cmd module. Install x-cmd first (see x-cmd skill for installation options). see x-cmd skill for installation.
x-ps
Enhanced ps process viewer with interactive UI, fzf support, AI filtering, and CSV/JSON/TSV output formats. Dependency: This is an x-cmd module. Install x-cmd first (see x-cmd skill for installation options). see x-cmd skill for installation.
netlify-deploy
Deploy web projects to Netlify using the Netlify CLI (npx netlify). Use when the user asks to deploy, host, publish, or link a site/repo on Netlify, including preview and production deploys.
web-design
网页设计与部署。生成精美的单页 HTML 网页（报告、落地页、数据可视化等），支持一键部署到 Cloudflare Pages。使用 Tailwind CSS + Chart.js + Font Awesome 技术栈。当用户要求制作网页、生成报告页面、创建落地页、数据可视化展示、部署网页到线上时使用。.