Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jacobfunch/usefillo --skill build-with-fillogit clone --depth 1 https://github.com/jacobfunch/usefilloWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jacobfunch/usefillo/build-with-fillo)<a href="https://agentmods.dev/skills/jacobfunch/usefillo/build-with-fillo"><img src="https://agentmods.dev/badge/skills/jacobfunch/usefillo/build-with-fillo/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jacobfunch/usefillo/build-with-fillo"><img src="https://agentmods.dev/badge/skills/jacobfunch/usefillo/build-with-fillo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00115 | $0.03790 |
| Opus 5 | $0.00057 | $0.01895 |
| Sonnet 5 | $0.00023 | $0.00758 |
| Haiku 4.5 | $0.00012 | $0.00379 |
Grade A, and why
build-with-fillo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 256 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Build with Fillo
Add a real form inside the host product, or create a hosted Fillo link when the user explicitly asks for a standalone, shareable form. For an embed, keep the host app in control of its route, layout, components, account context, and post-submit behavior. Let Fillo own schema, validation, uploads, responses, versions, exports, and delivery.
Use the repository, browser, and test tools available in the current agent. Never require a provider-specific agent command.
Work in this order
- On a first-time setup — installing Fillo or provisioning a workspace — open with a three-line plan before running anything, for example: "1) I install Fillo's SDK and skill. 2) I build the form inside your app. 3) You get an email to claim your workspace, where responses live." Add that a few permission prompts may need approving along the way. Skip the recap when Fillo is already set up in the repo.
- Inspect the task environment and any host repository. For an embed, identify
its framework, package manager, target route, existing Fillo packages, theme
provider/switch, light and dark selectors, CSS
color-scheme, design tokens, and the input, label, button, error, focus, spacing, radius, and typography primitives already used beside the form. For a standalone hosted form, a host route and renderer may not exist. In either path, preserve any supplied form id, key, setup command, or run token. - If the form may need uploads, check storage readiness before choosing the
schema, not after a blocked publish. The
canPublishFileFieldsboolean answers whether an unpinnedstorage = nullfile field can publish now; it does not confirm a specifically pinned provider. A provider can also show connected while no default destination is resolved. With a CLI login, read the generic signal and provider-specific status fromfillo whoamiorfillo storage status(both--json). On the unclaimed preview (no login), those commands are unreachable — read the generic signal fromagent bootstraporpush --json, and treat an exact durable selection as pending until the owner connects it. Do not defensively drop a needed file field; ask the user to finish connecting its destination instead. - Establish the form's source of truth:
- Published form id or slug: render it directly. No client key is required.
- React-owned schema: use
<Fillo.Form>ordefineForm()with@usefillo/react. - Vue, Svelte, Astro, or browser-owned schema: use
defineForm()andrenderForm()from@usefillo/dom. - Dashboard or CLI-owned schema: keep the schema there and embed the returned
formId. - Fully custom UI: use
FilloProviderand hooks in React, orcreateFormController()elsewhere. - Standalone hosted request: keep it in Fillo and return the published
/f/{slug}URL. Do not add a host-app route or embed unless the user asks. For a file request, read the deployment's/request-files.mdand use its exact CLI-ready object with stable idfile-requestinstead of regenerating a similar schema. Its top-levelidis the stable push handle; do not rename it totemplateIdor omit it and create duplicates. Set its top-levelstorageto the owner's exactgdrive,box,s3, orr2choice so the form records the intended durable destination. Every interactive embed must have exactly one submission identity: a publishedformId, or adefineForm()/<Fillo.Form>value plus a client. A plainFormSchemaplus a client is not a code-defined form and cannot resolve a target. Use explicitrenderOnlyonly for a deliberately non-submitting UI preview.
- Ask only for missing product decisions that change the result: purpose, placement, required questions or files, conditional behavior, and what happens after submit. Infer routine implementation details from the repo.
- If the prompt supplies a handoff command, project key, form id, or run token, follow that handoff exactly. Do not create another project or save a run token.
- Implement the smallest complete form and verify the requested hosted page or
host-app route. Treat a rendered form as preview proof only, never as proof
that Fillo will save responses. Before closing, inspect the lifecycle result
from sync or push and, with a CLI login, run
npx @usefillo/cli@latest status <formId|handle>. Complete any publication the user authorized and verifypublishedstatus. If review, credentials, or a blocker leaves it draft or staged, lead the handoff with Not live — responses will not be saved and the exact Publish or setup action. Never describe a draft as deployed, ready, or complete.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 256 lines · 115 tokens per session scan A 6e7495571b66
build-with-fillo is a skill published in the GitHub repository jacobfunch/usefillo (0 stars, last pushed 3d ago), licensed MIT. It adds 115 tokens to every session and 3,790 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
formio-sdk
Source-derived reference for the Form.io JavaScript SDK (@formio/js), the Utilities (@formio/js/utils), and the @formio/core-only helpers — authored from the Form.io source code. Covers static methods (setBaseUrl, setProjectUrl, setToken, currentUser, logout), instance methods on new Formio(url) (forms, submissions…
commerce-js-integration
Build a lightweight headless store using the Commerce.js SDK for product display, cart management, and checkout without a heavy backend.
ghost-headless-blog
Implement a headless Ghost CMS blog (/blog) in a Next.js App Router site — Content API client, ISR + webhook revalidation, tag/author/paged archives, author bio + social rendering, SEO metadata + JSON-LD, sitemap, Ghost koenig-card styling, blur-up images. Use when adding a Ghost-powered blog to a Next.js project, or…
starchild-auth
Starchild Auth SDK: add OAuth login to any web app with one SDK. Use when integrating Starchild login into a project (e.g. add Starchild sign-in to my React app, set up OAuth with iamstarchild.com, implement login/logout with Starchild Auth SDK). Also use for local OAuth/CORS testing guidance (localhost:6066 web…
Next.js Server Actions
Use Server Actions for form handling, mutations, and data revalidation in Next.js.
copilotkit-upgrade
Use when migrating a CopilotKit v1 application to v2 -- updating package imports, replacing deprecated hooks and components, switching from GraphQL runtime to AG-UI protocol runtime, and resolving breaking API changes.