Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add j4flmao/agent-skills --skill vaporgit clone --depth 1 https://github.com/j4flmao/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/j4flmao/agent-skills/vapor)<a href="https://agentmods.dev/skills/j4flmao/agent-skills/vapor"><img src="https://agentmods.dev/badge/skills/j4flmao/agent-skills/vapor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/j4flmao/agent-skills/vapor"><img src="https://agentmods.dev/badge/skills/j4flmao/agent-skills/vapor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 52 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 599 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.04671 |
| Opus 5 | $0.00037 | $0.02336 |
| Sonnet 5 | $0.00015 | $0.00934 |
| Haiku 4.5 | $0.00007 | $0.00467 |
Grade A, and why
vapor-backend scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 624 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vapor Backend
Purpose
Define Vapor backend application architecture: async routes, Fluent ORM, middleware pipeline, and Swift Package Manager project structure.
Agent Protocol
Trigger
User request includes: vapor, vapor backend, vapor swift, fluent, vapor async, swift server, vapor route, vapor middleware, vapor websocket.
Input Context
- Swift version (5.9+)
- Vapor version (4.x)
- Database driver (Fluent — PostgreSQL, MySQL, SQLite, MongoDB)
- Hosting (Vapor Cloud, Docker, bare metal)
- Features (REST, WebSocket, APNs, Leaf templates)
Output Artifact
A markdown document containing:
- Project structure (SPM layout)
- Route registration conventions
- Controller pattern
- Fluent model and migration setup
- Middleware pipeline ordering
- Environment-based configuration
- Testing (XCTest, XCTVapor)
- WebSocket endpoint setup
Response Format
Produce the artifact directly. No preamble, no postamble, no explanations. No filler, no hedging. Compress output.
Completion Criteria
- SPM Package.swift correctly declares dependencies
- Routes registered with route groups
- Fluent models with proper migrations
- Middleware pipeline ordered (auth -> logging -> error)
- Environment configuration via .env files
- Tests cover request lifecycle
Max Response Length
4096 tokens
Workflow
Step 1: Project Setup
# Install Vapor toolbox
brew install vapor
# Create project
vapor new OrderService --template web
# Or manually
mkdir OrderService && cd OrderService
swift package init --type executable
# Add Vapor and Fluent
swift package add https://github.com/vapor/vapor
swift package add https://github.com/vapor/fluent
swift package add https://github.com/vapor/fluent-postgres-driver
Step 2: Package.swift
// swift-tools-version:5.9
import PackageDescription
let package = Package(
name: "OrderService",
platforms: [.macOS(.v13)],
dependencies: [
.package(url: "https://github.com/vapor/vapor", from: "4.90.0"),
.package(url: "https://github.com/vapor/fluent", from: "4.9.0"),
.package(url: "https://github.com/vapor/fluent-postgres-driver", from: "2.8.0"),
.package(url: "https://github.com/vapor/leaf", from: "4.3.0"),
.package(url: "https://github.com/vapor/jwt", from: "4.3.0"),
],
targets: [
.executableTarget(
name: "App",
dependencies: [
.product(name: "Vapor", package: "vapor"),
.product(name: "Fluent", package: "fluent"),
.product(name: "FluentPostgresDriver", package: "fluent-postgres-driver"),
.product(name: "Leaf", package: "leaf"),
.product(name: "JWT", package: "jwt"),
]
),
.testTarget(name: "AppTests", dependencies: [.target(name: "App")]),
]
)
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 624 lines · 75 tokens per session scan A ef62e1bc6a6f
vapor-backend is a skill published in the GitHub repository j4flmao/agent-skills (22 stars, last pushed 4d ago), licensed MIT. It adds 75 tokens to every session and 4,671 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
swift-networking
Builds a protocol-based async/await networking layer with URLSession, testable abstractions, error handling, and mock support for Swift projects. Use when user says "add networking", "create an API layer", "fetch data from API", "build a network service", "add URLSession", "implement HTTP requests", "create a REST…
swift-codable
Master serialization and deserialization in Swift with Codable. Use when implementing custom CodingKeys, date/data decoding strategies, polymorphic/mixed collections, lossy array decoding, property wrappers for default values, or bridging Codable with SwiftData/CoreData persistence.
kotlin-ktor-patterns
Ktor server patterns including routing DSL, plugins, authentication, Koin DI, kotlinx.serialization, WebSockets, and testApplication testing.
swift-concurrency
Diagnose Swift Concurrency issues, refactor callback-based code to async/await, and guide Swift 6 migration when working with tasks, actors, @MainActor, Sendable, data races, thread safety, or concurrency-related compiler and linter warnings.
authoring-java-sdk-tasks
Writes Airflow task logic in Java, Kotlin, or any JVM language using the Airflow Java SDK. Use when the user wants to implement Airflow tasks in Java/JVM, asks about @Builder.Dag/@Builder.Task/@Builder.XCom, the Task/BundleBuilder interfaces, reading connections/variables/XComs from Java, the JSON-to-Java type…
null-safety
Use when annotating nullability in Spring Boot 3 / Spring Framework 6 code, integrating Kotlin, or adding static nullability checks without assuming Spring Framework 7 JSpecify defaults.