build-with-fillo

build-with-fillo is a skill for Claude Code, Codex from jacobfunch/usefillo. It costs 115 tokens per session (4,687 once invoked), scanned A, original, MIT.

A set of instructions for creating and embedding Fillo forms in web apps. Fillo is a form service that manages form fields, validation, uploads, responses, versions, exports, and delivery.

In plain words
What is it for?
Building, styling, embedding, pre-filling, syncing, publishing, and checking Fillo forms in React, Next.js, Vue, Svelte, Astro, or browser applications.
Why use it?
It helps connect a real form to an existing app without manually building and maintaining all of those form features.

Skill for Claude CodeCodex

Written for Claude Code and Codex: shipped in a Claude Code plugin, but also agents/openai.yaml present.

Part of the fillo plugin — 1 skill, 1 MCP server shipped together

Good fit Building, styling, embedding, pre-filling, syncing, publishing, and checking Fillo forms in React, Next.js, Vue, Svelte, Astro, or browser applications.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/jacobfunch/usefillo/build-with-fillo
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add jacobfunch/usefillo --skill build-with-fillo
Clone the repo
git clone --depth 1 https://github.com/jacobfunch/usefillo

Made for: Claude Code, Codex.

Or install fillo, the plugin that ships this one along with the rest of its 1 skill, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for build-with-fillo

README.md
[![agentmods](https://agentmods.dev/badge/skills/jacobfunch/usefillo/build-with-fillo/github.svg)](https://agentmods.dev/skills/jacobfunch/usefillo/build-with-fillo)
Your own site
<a href="https://agentmods.dev/skills/jacobfunch/usefillo/build-with-fillo"><img src="https://agentmods.dev/badge/skills/jacobfunch/usefillo/build-with-fillo/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for build-with-fillo

Your own site · 80×15
<a href="https://agentmods.dev/skills/jacobfunch/usefillo/build-with-fillo"><img src="https://agentmods.dev/badge/skills/jacobfunch/usefillo/build-with-fillo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 115 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,687 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00115 $0.04687
Opus 5.5 $0.00046 $0.01875
Sonnet 5.5 $0.00023 $0.00937
Haiku 4.5 $0.00012 $0.00469

Measured 20d ago against content hash aeefffefd7ed, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

build-with-fillo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/fillo/skills/build-with-fillo/SKILL.md · 306 lines

How it starts

The opening of the file, as written. The whole thing — 306 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Build with Fillo

Add a real form inside the host product, or create a hosted Fillo link when the user explicitly asks for a standalone, shareable form. For an embed, keep the host app in control of its route, layout, components, account context, and post-submit behavior. Let Fillo own schema, validation, uploads, responses, versions, exports, and delivery.

Use the repository, browser, and test tools available in the current agent. Never require a provider-specific agent command.

At the start of each Fillo task, unless tooling is explicitly pinned or FILLO_AUTO_UPDATE=0, run npx -y @usefillo/cli@latest --agent-help. This refreshes CLI-managed copies of this skill in the current project and user scope. If your installed copy changed, read its SKILL.md again before acting. CLI and local MCP updates use the stable npm release with an hourly check and an offline fallback. FILLO_AUTO_UPDATE=0 pins installed tooling; respect that choice and project dependency constraints. SDK upgrades use the host package manager and its lockfile. Plugin-managed skills follow the host's plugin updater.

Work in this order

  1. On a first-time setup — installing Fillo or provisioning a workspace — open with a three-line plan before running anything, for example: "1) I install Fillo's SDK and skill. 2) I build the form inside your app. 3) You get an email to claim your workspace, where responses live." Add that a few permission prompts may need approving along the way. Then, if their work email is not already in this task, ask them for it once. Do not invent an address, infer or scrape it, or use a documentation placeholder as the address. Run npx @usefillo/cli@latest agent bootstrap --email <their email> with the address they give you. Skip the recap and the email ask when Fillo is already set up in the repo or a handoff already supplied a workspace.
  2. Inspect the task environment and any host repository. For an embed, identify its framework, package manager, target route, existing Fillo packages, theme provider/switch, light and dark selectors, CSS color-scheme, design tokens, and the input, label, button, error, focus, spacing, radius, and typography primitives already used beside the form. For a standalone hosted form, a host route and renderer may not exist. In either path, preserve any supplied form id, key, setup command, or run token.
  3. If the form may need uploads, check storage readiness before choosing the schema, not after a blocked publish. The canPublishFileFields boolean answers whether an unpinned storage = null file field can publish now; it does not confirm a specifically pinned provider. A provider can also show connected while no default destination is resolved. With a CLI login, read the generic signal and provider-specific status from fillo whoami or fillo storage status (both --json). On the unclaimed preview (no login), those commands are unreachable — read the generic signal from agent bootstrap or push --json, and treat an exact durable selection as pending until the owner connects it. Do not defensively drop a needed file field; ask the user to finish connecting its destination instead.
  4. Establish the form's source of truth:
    • Published form id or slug: render it directly. No client key is required.
    • React-owned schema: use <Fillo.Form> or defineForm() with @usefillo/react.
    • Vue, Svelte, Astro, or browser-owned schema: use defineForm() and renderForm() from @usefillo/dom.
    • Dashboard or CLI-owned schema: keep the schema there and embed the returned formId.
    • Fully custom UI: use FilloProvider and hooks in React, or createFormController() elsewhere.
    • Standalone hosted request: keep it in Fillo and return the published /f/{slug} URL. Do not add a host-app route or embed unless the user asks. For a file request, read the deployment's /request-files.md and use its exact CLI-ready object with stable id file-request instead of regenerating a similar schema. Its top-level id is the stable push handle; do not rename it to templateId or omit it and create duplicates. Set its top-level storage to the owner's exact gdrive, box, s3, or r2 choice so the form records the intended durable destination. Every interactive embed must have exactly one submission identity: a published formId, or a defineForm() / <Fillo.Form> value plus a client. A plain FormSchema plus a client is not a code-defined form and cannot resolve a target. Use explicit renderOnly only for a deliberately non-submitting UI preview.
  5. Ask only for missing product decisions that change the result: purpose, placement, required questions or files, conditional behavior, and what happens after submit. Infer routine implementation details from the repo.
  6. If the prompt supplies a handoff command, project key, form id, or run token, follow that handoff exactly. Do not create another project or save a run token.
  7. Implement the smallest complete form and verify the requested hosted page or host-app route. Treat a rendered form as preview proof only, never as proof that Fillo will save responses. Before closing, inspect the lifecycle result from sync or push and, with a CLI login, run npx @usefillo/cli@latest status <formId|handle>. Complete any publication the user authorized and verify published status. If review, credentials, or a blocker leaves it draft or staged, lead the handoff with Not live — responses will not be saved and the exact Publish or setup action. Never describe a draft as deployed, ready, or complete.

Read the full file on GitHub · 306 lines

Files

What ships with it

8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 20d ago Changed · +9 lines aeefffefd7ed
  2. 29d ago Changed · +11 lines 1461ab9dcbc0
  3. 1mo ago Changed · +9 lines 40236fb55621
  4. 1mo ago Changed · +17 lines f319ceb64bbc
  5. 1mo ago Changed · +4 lines f352f894c2ff
  6. 1mo ago First seen · 256 lines · 115 tokens per session scan A 6e7495571b66

Subscribe to this mod's changes

build-with-fillo is a skill published in the GitHub repository jacobfunch/usefillo (0 stars, last pushed 11d ago), licensed MIT. It adds 115 tokens to every session and 4,687 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

commerce-js-integration

Build a lightweight headless store using the Commerce.js SDK for product display, cart management, and checkout without a heavy backend.

finsilabs/awesome-ecommerce-skills · 29 tokens

starchild-auth

Starchild Auth SDK: add OAuth login to any web app with one SDK. Use when integrating Starchild login into a project (e.g. add Starchild sign-in to my React app, set up OAuth with iamstarchild.com, implement login/logout with Starchild Auth SDK). Also use for local OAuth/CORS testing guidance (localhost:6066 web…

Starchild-ai-agent/official-skills · 92 tokens

nextjs-pages-router

Set up tRPC in Next.js Pages Router with createNextApiHandler, createTRPCNext, withTRPC HOC, SSR via ssr option and ssrPrepass, SSG via createServerSideHelpers with getStaticProps, and server-side helpers for getServerSideProps prefetching.

trpc/trpc · 67 tokens

middlewares

Create and compose tRPC middleware with t.procedure.use(), extend context via opts.next({ ctx }), build reusable middleware with .concat() and .unstablepipe(), define base procedures like publicProcedure and authedProcedure. Access raw input with getRawInput(). Logging, timing, OTEL tracing patterns.

trpc/trpc · 63 tokens

non-json-content-types

Handle FormData, file uploads, Blob, Uint8Array, and ReadableStream inputs in tRPC mutations. Use octetInputParser from @trpc/server/http for binary data. Route non-JSON requests with splitLink and isNonJsonSerializable() from @trpc/client. FormData and binary inputs only work with mutations (POST).

trpc/trpc · 75 tokens

server-side-calls

Call tRPC procedures directly from server code using t.createCallerFactory() and router.createCaller(context) for integration testing, internal server logic, and custom API endpoints. Catch TRPCError and extract HTTP status with getHTTPStatusCodeFromError(). Error handling via onError option.

trpc/trpc · 61 tokens