Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kavo-labs/kavo --skill quick-startgit clone --depth 1 https://github.com/kavo-labs/kavoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kavo-labs/kavo/quick-start)<a href="https://agentmods.dev/skills/kavo-labs/kavo/quick-start"><img src="https://agentmods.dev/badge/skills/kavo-labs/kavo/quick-start.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.02103 |
| Opus 5 | $0.00058 | $0.01052 |
| Sonnet 5 | $0.00023 | $0.00421 |
| Haiku 4.5 | $0.00012 | $0.00210 |
Grade B, and why
quick-start scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -X POST localhost:3000/cats -H "content-type: application/json" -d '{"name":"Whiskers","age":3}' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -X POST localhost:3000/cats -H "content-type: application/json" -d '{"name":"Whiskers","age":3}' How it starts
The opening of the file, as written. The whole thing — 263 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Quick start — new project, SQLite + Nest + TypeORM only
The fastest working slice: one entity, one controller, zero DTOs, an
on-disk SQLite file. No Postgres, no GraphQL, no bulk — add those later
from the other skills (kavo-decorator, global-config, dto-slots,
graphql-binding) once this runs. Swagger docs are one optional step,
covered at the end (§9).
This page is the TypeORM path. Steps 1–3 and 5–9 are the same whatever ORM you use, but the entity in §4 and the wiring in §6 are TypeORM-specific and do not carry over. On another ORM, read its skill for those two steps:
| ORM | Skill | The part that differs |
|---|---|---|
| Prisma | prisma-adapter |
Needs a marker class per model — no runtime class |
| Mongoose | mongoose-adapter |
The model is the entity; ids are hex strings |
| MikroORM | mikroorm-adapter |
Pass the MikroORM instance, not an EntityManager |
1. Create the project
mkdir my-kavo-app && cd my-kavo-app
npm init -y
Set "type": "module" in package.json — every @kavo/* package ships as
ESM only:
{
"name": "my-kavo-app",
"type": "module",
"scripts": {
"build": "tsc -b",
"start": "node dist/main.js"
}
}
2. Install packages
Runtime dependencies — Nest, TypeORM, the SQLite driver, and the three
@kavo/* packages:
npm install @nestjs/common @nestjs/core @nestjs/platform-express \
reflect-metadata rxjs typeorm better-sqlite3 \
@kavo/core @kavo/nest @kavo/typeorm
Dev dependencies — TypeScript and Node types only (no test runner needed for this quick start):
npm install -D typescript @types/node
That's the whole install — no @nestjs/swagger (optional peer, skip it
until you want generated API docs) and no graphql (optional peer, only
needed for the graphql-binding skill).
3. tsconfig.json
Decorator metadata (emitDecoratorMetadata) is load-bearing — both
TypeORM's entity columns and Nest's DI need it:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 263 lines · 116 tokens per session scan B f536693663fe
quick-start is a skill published in the GitHub repository kavo-labs/kavo (12 stars, last pushed today), licensed Apache-2.0. It adds 116 tokens to every session and 2,103 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-02.
Other skills, from other repositories
servicenow-table-api
Foundational ServiceNow data access — generic Table API CRUD, Aggregate/stats roll-ups, and raw REST escape-hatch via the servicenow-api MCP server. Use when the agent must read, insert, update, patch, delete, count, or aggregate records in ANY ServiceNow table (including scoped app tables with no dedicated API), or…
horse-database-pooling
Guide for setting up thread-safe database connection pooling (FireDAC / UniDAC) in multithreaded Horse applications.
ocli-api
Turn any OpenAPI/Swagger API into CLI commands and call them. Search endpoints with BM25, check parameters, execute — no MCP server needed.
db-infra-mocks
Propose minimal seams and local substitutes so tests run without real RDBMS/Redis/Mongo infrastructure.
fastcrud
Use when building or modifying CRUD endpoints with FastCRUD (the fastcrud PyPI package) in a FastAPI project — covers FastCRUD, crudrouter, EndpointCreator, FilterConfig, JoinConfig, auto-relationship detection, the filter operator syntax (gte, in, ilike, etc.), cursor pagination, soft delete, and how to avoid N+1…
mail-time
Use when building, wiring, reviewing, or debugging MailTime and ostrio:mailer email queues for horizontally scaled Node.js, Bun, or Meteor apps. Trigger on MailTime, MongoQueue, RedisQueue, PostgresQueue, mailTimePreset, JoSk email scheduling, Redis Cluster / KeyDB Cluster / Valkey useHashTags, KeyDB…