Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ivklgn/ai-kit/12-factor-appsnpx skills add ivklgn/ai-kit --skill 12-factor-appsgit clone --depth 1 https://github.com/ivklgn/ai-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ivklgn/ai-kit/12-factor-apps)<a href="https://agentmods.dev/skills/ivklgn/ai-kit/12-factor-apps"><img src="https://agentmods.dev/badge/skills/ivklgn/ai-kit/12-factor-apps.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.04781 |
| Opus 5 | $0.00022 | $0.02390 |
| Sonnet 5 | $0.00009 | $0.00956 |
| Haiku 4.5 | $0.00004 | $0.00478 |
Grade A, and why
12-factor-apps scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
grep -r "subprocess.*curl\|subprocess.*wget\|os.system.*ffmpeg\|shutil.which" --include="*.py" Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
grep -r "subprocess.*curl\|subprocess.*wget\|os.system.*ffmpeg\|shutil.which" --include="*.py" This is a copy
94% identical to 12-factor-apps — 6 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 547 lines — stays where its author put it; the contents beside it link to each section on GitHub.
12-Factor App Compliance Analysis
Source & attribution. Ported from the
12-factor-appsskill by anderskev, published on clawhub.ai (https://clawhub.ai/anderskev/12-factor-apps), released under MIT-0. Methodology: The Twelve-Factor App by Adam Wiggins. SeeATTRIBUTION.md.
Overview
The 12-Factor App methodology is a set of best practices for building Software-as-a-Service applications that are:
- Portable across execution environments
- Scalable without architectural changes
- Suitable for continuous deployment
- Maintainable with minimal friction
Input Parameters
| Parameter | Description | Required |
|---|---|---|
codebase_path |
Root path of the codebase to analyze | Required |
Analysis Framework
Factor I: Codebase
Principle: One codebase tracked in revision control, many deploys.
Search Patterns:
# Check for version control
ls -la .git 2>/dev/null || ls -la .hg 2>/dev/null
# Check for multiple apps sharing codebase
find . -name "package.json" -o -name "pyproject.toml" -o -name "setup.py" | head -20
# Check for environment-specific code branches
grep -r "if.*production\|if.*development\|if.*staging" --include="*.py" --include="*.js" --include="*.ts"
File Patterns: .git/, package.json, pyproject.toml, deployment configs
Compliance Criteria:
| Level | Criteria |
|---|---|
| Strong | Single Git repo, same codebase for all environments, no env-specific code branches |
| Partial | Single repo but some environment-specific code paths |
| Weak | Multiple repos for same app or significant code duplication across environments |
Anti-patterns:
- Multiple Git repositories for the same application
- Environment-specific code branches (
if production: ...) - Different source files for dev vs prod
- Shared code not extracted to libraries
Factor II: Dependencies
Principle: Explicitly declare and isolate dependencies.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 547 lines · 43 tokens per session scan A 0b619a198cb8
12-factor-apps is a skill published in the GitHub repository ivklgn/ai-kit (12 stars, last pushed yesterday), licensed MIT. It adds 43 tokens to every session and 4,781 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). It is 94% identical to 12-factor-apps, differing in 6 lines, and is treated as a copy.
Other skills, from other repositories
om-ds-guardian
Design System Guardian for Open Mercato. Use for frontend UI work, design-system compliance reviews, semantic token migration, hardcoded color or typography cleanup, DS-compliant page scaffolding, and common DS violations such as arbitrary text sizes, raw color classes, or missing shared states. Prefer this skill…
om-implement-spec
Implement a specification (or specific phases) using coordinated subagents with unit tests, integration tests, docs, and code-review compliance. Tracks progress by updating the spec. Triggers on "implement spec", "implement phases", "build from spec", "code the spec".
personal-data-protection
Personal-data-protection compliance reference for engineers building applications subject to Singapore PDPA, Indonesia UU PDP 27/2022, Thailand PDPA B.E. 2562 (2019), Malaysia PDPA 2010 (with the 2024 Amendments), or Philippines DPA (RA 10173). Use when reviewing or modifying code that touches personal data …
moai-foundation-quality
TRUST 5 quality principles and how MoAI enforces them through agents, the 3-level harness, /moai gate, and sync-auditor scoring. Use for code review, quality gate checks, coverage targets, or TRUST 5 compliance.
memstack-business-gdpr
Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR…
ss-review
Review UI code for design system compliance, accessibility, and best practices.