Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Hipson47/Hipson --skill cv-webapp-startergit clone --depth 1 https://github.com/Hipson47/HipsonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hipson47/hipson/cv-webapp-starter)<a href="https://agentmods.dev/skills/hipson47/hipson/cv-webapp-starter"><img src="https://agentmods.dev/badge/skills/hipson47/hipson/cv-webapp-starter.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.01275 |
| Opus 5 | $0.00018 | $0.00638 |
| Sonnet 5 | $0.00007 | $0.00255 |
| Haiku 4.5 | $0.00004 | $0.00128 |
Grade A, and why
cv-webapp-starter scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Computer Vision Webapp Starter
Purpose
Define the first production-shaped web boundary around a CV pipeline. Choose between a Next.js frontend/BFF with FastAPI inference and browser-only MediaPipe, then specify typed contracts, upload/camera limits, auth, artifacts, privacy, and verification before scaffolding code.
Use When
- A browser uploads images to a Python/OpenCV/model pipeline.
- Next.js needs a same-origin route handler/BFF in front of FastAPI.
- A browser camera drives MediaPipe gesture or pose UI.
- OpenAPI-generated TypeScript clients and Problem Details errors are required.
Do Not Use When
- The deliverable is only a local Python script or dataset operation.
- The CV model/task is undecided; route it first.
- Live high-rate video streaming is assumed without a latency, privacy, and transport design.
Inputs
- Existing frontend/backend stack, auth model, deployment topology, and API style.
- Input modality, maximum bytes/dimensions/pixels/duration, accepted decoded formats, timeout, concurrency, and retention.
- Inference contract, allowlisted model, expected JSON, annotated artifact rules, and browser overlay coordinate requirements.
- Privacy, logging, data residency, threat model, and local/offline expectations.
Default Stack
- Next.js App Router with Server Components by default and a small client camera island only where interaction requires it.
- Next.js route handler/BFF for same-origin browser traffic and server-side auth.
- FastAPI async endpoint, Pydantic v2 response models, and OpenAPI as the source of truth for generated TypeScript clients.
- OpenCV decode plus a server-side allowlisted model for uploads.
- Browser-side MediaPipe for supported gesture/pose tasks, with no frame upload.
Workflow
- Inspect the repository's routing, auth, API client generation, error, test, upload, and configuration conventions before choosing the architecture.
- Use Next.js BFF -> FastAPI for server inference. Permit direct browser -> FastAPI only for an explicit localhost prototype with narrow CORS and no secrets. Use browser MediaPipe for supported low-latency gesture/pose UI.
- Define
POST /v1/detectionsas multipart image input. Ignore the supplied filename; stream a byte limit; decode and validate signature, format, dimensions, pixel count, timeout, and concurrency. - Keep model selection in server configuration. Reject request-provided model paths, URLs, pickles, arbitrary parameters, and remote code.
- Return Pydantic-validated, versioned detection JSON. Use
application/problem+jsonwith stablecodeandrequest_idfor errors. Add liveness separately from model-readiness checks. - Export OpenAPI and generate the TypeScript client. Do not hand-maintain a duplicate detection response type.
- Store uploads only in isolated temporary storage when memory processing is unsuitable. Clean up on success, error, timeout, disconnect, and cancellation. Serve derived artifacts through opaque, authorized, expiring identifiers.
- Enforce authentication/authorization at the API/data boundary when users or private artifacts exist. Add rate, request-size, timeout, and concurrency limits before any non-local exposure.
- For camera UI, request permission after user action, show active/stop state, stop tracks on navigation, and provide non-camera controls.
- End with
vision-verifier; keep webcam streaming/WebRTC as a later, separately threat-modeled extension.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 125 lines · 36 tokens per session scan A 8823ddef352d
cv-webapp-starter is a skill published in the GitHub repository Hipson47/Hipson (4 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 36 tokens to every session and 1,275 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
kirby-collections-and-navigation
Builds Kirby listings, pagination, search, filtering/sorting/grouping, and navigation menus. Use when implementing collection logic in templates/controllers/snippets.
kirby-forms-and-frontend-actions
Implements frontend forms and actions in Kirby (contact forms, file uploads, email with attachments, creating pages from frontend). Use when handling user input or building submission flows.
kirby-performance-and-media
Improves Kirby performance and media delivery (cache tuning, CDN, responsive images, lazy loading). Use when optimizing page speed, caching, or image handling.
agent-support-matrix
Maintain Agent Sessions agent support matrix and JSON/JSONL parsing compatibility. Use when checking upstream agent releases for session format changes, updating max verified versions in docs/agent-support/agent-support-matrix.yml, or updating docs/agent-json-tracking.md and fixtures/tests.
solon-development-skill
Solon Java framework expert (NOT Spring). Use for Solon apps, Solon AI (ChatModel/RAG/MCP/Agent/Harness/Talent), Solon Flow, Solon Cloud, Nami RPC, SqlUtils/MyBatis, and Solon annotations (@Mapping, @Inject, @SolonMain, @Component). Independent IoC/AOP and plugins — never use Spring annotations or spring-boot…
kirby-debugging-and-tracing
Diagnoses Kirby rendering/runtime issues using MCP runtime rendering, dump traces, and template/snippet/controller indexes. Use when outputs are wrong, errors occur, or tracing execution paths is required.