Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jacobfunch/usefillo --skill build-with-fillogit clone --depth 1 https://github.com/jacobfunch/usefilloWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jacobfunch/usefillo/build-with-fillo)<a href="https://agentmods.dev/skills/jacobfunch/usefillo/build-with-fillo"><img src="https://agentmods.dev/badge/skills/jacobfunch/usefillo/build-with-fillo/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jacobfunch/usefillo/build-with-fillo"><img src="https://agentmods.dev/badge/skills/jacobfunch/usefillo/build-with-fillo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00115 | $0.04687 |
| Opus 5.5 | $0.00046 | $0.01875 |
| Sonnet 5.5 | $0.00023 | $0.00937 |
| Haiku 4.5 | $0.00012 | $0.00469 |
Grade A, and why
build-with-fillo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 306 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Build with Fillo
Add a real form inside the host product, or create a hosted Fillo link when the user explicitly asks for a standalone, shareable form. For an embed, keep the host app in control of its route, layout, components, account context, and post-submit behavior. Let Fillo own schema, validation, uploads, responses, versions, exports, and delivery.
Use the repository, browser, and test tools available in the current agent. Never require a provider-specific agent command.
At the start of each Fillo task, unless tooling is explicitly pinned or
FILLO_AUTO_UPDATE=0, run npx -y @usefillo/cli@latest --agent-help.
This refreshes CLI-managed copies of this skill in the current project and user
scope. If your installed copy changed, read its SKILL.md again before acting.
CLI and local MCP updates use the stable npm release with an hourly check and
an offline fallback. FILLO_AUTO_UPDATE=0 pins installed tooling; respect that
choice and project dependency constraints. SDK upgrades use the host package
manager and its lockfile. Plugin-managed skills follow the host's plugin updater.
Work in this order
- On a first-time setup — installing Fillo or provisioning a workspace — open
with a three-line plan before running anything, for example: "1) I install
Fillo's SDK and skill. 2) I build the form inside your app. 3) You get an
email to claim your workspace, where responses live." Add that a few
permission prompts may need approving along the way. Then, if their work
email is not already in this task, ask them for it once. Do not invent an
address, infer or scrape it, or use a documentation placeholder as the
address. Run
npx @usefillo/cli@latest agent bootstrap --email <their email>with the address they give you. Skip the recap and the email ask when Fillo is already set up in the repo or a handoff already supplied a workspace. - Inspect the task environment and any host repository. For an embed, identify
its framework, package manager, target route, existing Fillo packages, theme
provider/switch, light and dark selectors, CSS
color-scheme, design tokens, and the input, label, button, error, focus, spacing, radius, and typography primitives already used beside the form. For a standalone hosted form, a host route and renderer may not exist. In either path, preserve any supplied form id, key, setup command, or run token. - If the form may need uploads, check storage readiness before choosing the
schema, not after a blocked publish. The
canPublishFileFieldsboolean answers whether an unpinnedstorage = nullfile field can publish now; it does not confirm a specifically pinned provider. A provider can also show connected while no default destination is resolved. With a CLI login, read the generic signal and provider-specific status fromfillo whoamiorfillo storage status(both--json). On the unclaimed preview (no login), those commands are unreachable — read the generic signal fromagent bootstraporpush --json, and treat an exact durable selection as pending until the owner connects it. Do not defensively drop a needed file field; ask the user to finish connecting its destination instead. - Establish the form's source of truth:
- Published form id or slug: render it directly. No client key is required.
- React-owned schema: use
<Fillo.Form>ordefineForm()with@usefillo/react. - Vue, Svelte, Astro, or browser-owned schema: use
defineForm()andrenderForm()from@usefillo/dom. - Dashboard or CLI-owned schema: keep the schema there and embed the returned
formId. - Fully custom UI: use
FilloProviderand hooks in React, orcreateFormController()elsewhere. - Standalone hosted request: keep it in Fillo and return the published
/f/{slug}URL. Do not add a host-app route or embed unless the user asks. For a file request, read the deployment's/request-files.mdand use its exact CLI-ready object with stable idfile-requestinstead of regenerating a similar schema. Its top-levelidis the stable push handle; do not rename it totemplateIdor omit it and create duplicates. Set its top-levelstorageto the owner's exactgdrive,box,s3, orr2choice so the form records the intended durable destination. Every interactive embed must have exactly one submission identity: a publishedformId, or adefineForm()/<Fillo.Form>value plus a client. A plainFormSchemaplus a client is not a code-defined form and cannot resolve a target. Use explicitrenderOnlyonly for a deliberately non-submitting UI preview.
- Ask only for missing product decisions that change the result: purpose, placement, required questions or files, conditional behavior, and what happens after submit. Infer routine implementation details from the repo.
- If the prompt supplies a handoff command, project key, form id, or run token, follow that handoff exactly. Do not create another project or save a run token.
- Implement the smallest complete form and verify the requested hosted page or
host-app route. Treat a rendered form as preview proof only, never as proof
that Fillo will save responses. Before closing, inspect the lifecycle result
from sync or push and, with a CLI login, run
npx @usefillo/cli@latest status <formId|handle>. Complete any publication the user authorized and verifypublishedstatus. If review, credentials, or a blocker leaves it draft or staged, lead the handoff with Not live — responses will not be saved and the exact Publish or setup action. Never describe a draft as deployed, ready, or complete.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 20d ago Changed · +9 lines aeefffefd7ed
- 29d ago Changed · +11 lines 1461ab9dcbc0
- 1mo ago Changed · +9 lines 40236fb55621
- 1mo ago Changed · +17 lines f319ceb64bbc
- 1mo ago Changed · +4 lines f352f894c2ff
- 1mo ago First seen · 256 lines · 115 tokens per session scan A 6e7495571b66
build-with-fillo is a skill published in the GitHub repository jacobfunch/usefillo (0 stars, last pushed 11d ago), licensed MIT. It adds 115 tokens to every session and 4,687 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
commerce-js-integration
Build a lightweight headless store using the Commerce.js SDK for product display, cart management, and checkout without a heavy backend.
starchild-auth
Starchild Auth SDK: add OAuth login to any web app with one SDK. Use when integrating Starchild login into a project (e.g. add Starchild sign-in to my React app, set up OAuth with iamstarchild.com, implement login/logout with Starchild Auth SDK). Also use for local OAuth/CORS testing guidance (localhost:6066 web…
nextjs-pages-router
Set up tRPC in Next.js Pages Router with createNextApiHandler, createTRPCNext, withTRPC HOC, SSR via ssr option and ssrPrepass, SSG via createServerSideHelpers with getStaticProps, and server-side helpers for getServerSideProps prefetching.
middlewares
Create and compose tRPC middleware with t.procedure.use(), extend context via opts.next({ ctx }), build reusable middleware with .concat() and .unstablepipe(), define base procedures like publicProcedure and authedProcedure. Access raw input with getRawInput(). Logging, timing, OTEL tracing patterns.
non-json-content-types
Handle FormData, file uploads, Blob, Uint8Array, and ReadableStream inputs in tRPC mutations. Use octetInputParser from @trpc/server/http for binary data. Route non-JSON requests with splitLink and isNonJsonSerializable() from @trpc/client. FormData and binary inputs only work with mutations (POST).
server-side-calls
Call tRPC procedures directly from server code using t.createCallerFactory() and router.createCaller(context) for integration testing, internal server logic, and custom API endpoints. Catch TRPCError and extract HTTP status with getHTTPStatusCodeFromError(). Error handling via onError option.