Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/konamgil/mandu/mandu-create-apinpx skills add konamgil/mandu --skill mandu-create-apigit clone --depth 1 https://github.com/konamgil/manduWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/konamgil/mandu/mandu-create-api)<a href="https://agentmods.dev/skills/konamgil/mandu/mandu-create-api"><img src="https://agentmods.dev/badge/skills/konamgil/mandu/mandu-create-api.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00033 | $0.01089 |
| Opus 5 | $0.00016 | $0.00544 |
| Sonnet 5 | $0.00007 | $0.00218 |
| Haiku 4.5 | $0.00003 | $0.00109 |
Grade B, and why
mandu-create-api scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
const res = await fetch("http://localhost:3333/api/posts", { method: "POST", How it starts
The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mandu Create API
REST API 엔드포인트를 생성하는 워크플로우. Route + Contract + Slot + Test 파이프라인으로 완전한 API를 스캐폴딩합니다.
Workflow: Route -> Contract -> Slot -> Test
Step 1: Route 생성
// app/api/posts/route.ts
import { Mandu } from "@mandujs/core";
export default Mandu.filling()
.get((ctx) => ctx.ok({ posts: [] }))
.post(async (ctx) => {
const body = await ctx.body<CreatePostInput>();
return ctx.created({ post: body });
});
Step 2: Contract 정의
// src/shared/contracts/post.contract.ts
import { z } from "zod";
export const CreatePostInput = z.object({
title: z.string().min(1).max(200),
content: z.string().min(1),
tags: z.array(z.string()).optional(),
});
export const PostResponse = z.object({
id: z.string(),
title: z.string(),
content: z.string(),
createdAt: z.string().datetime(),
});
export type CreatePostInput = z.infer<typeof CreatePostInput>;
export type PostResponse = z.infer<typeof PostResponse>;
Step 3: Slot (서버 데이터 로더)
// spec/slots/posts.slot.ts
import { Mandu } from "@mandujs/core";
import { CreatePostInput } from "@/shared/contracts/post.contract";
export default Mandu.filling()
.guard(async (ctx) => {
const token = ctx.headers.get("authorization");
if (!token) return ctx.error(401, "Unauthorized");
ctx.set("userId", await verifyToken(token));
})
.post(async (ctx) => {
const body = await ctx.body<CreatePostInput>();
const validated = CreatePostInput.parse(body);
const post = await db.posts.create({ ...validated, userId: ctx.get("userId") });
return ctx.created({ post });
});
Step 4: Test 작성
// tests/api/posts.test.ts
import { describe, test, expect } from "bun:test";
describe("POST /api/posts", () => {
test("creates a post with valid input", async () => {
const res = await fetch("http://localhost:3333/api/posts", {
method: "POST",
headers: {
"Content-Type": "application/json",
Authorization: "Bearer test-token",
},
body: JSON.stringify({ title: "Test", content: "Hello" }),
});
expect(res.status).toBe(201);
const data = await res.json();
expect(data.post.title).toBe("Test");
});
test("returns 401 without auth", async () => {
const res = await fetch("http://localhost:3333/api/posts", {
method: "POST",
body: JSON.stringify({ title: "Test", content: "Hello" }),
});
expect(res.status).toBe(401);
});
});
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 152 lines · 33 tokens per session scan B ff9e3b340ee6
mandu-create-api is a skill published in the GitHub repository konamgil/mandu (46 stars, last pushed 8d ago), licensed MPL-2.0. It adds 33 tokens to every session and 1,089 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (sends data to an external url). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-native-scaffold
Audit, scaffold, or refactor any software repository into the Agent-Native Repository Architecture (ANRS-1.0) with Hub-and-Spoke context, O(1) REGISTRY.yaml, and shallow directory ergonomics.
Architecture Reviewer
Architecture Reviewer delivers production-grade technical work with clear architecture, tests, maintainability, and operational awareness.
Full Stack Engineer
Full Stack Engineer delivers production-grade technical work with clear architecture, tests, maintainability, and operational awareness.
review-order-flow
Reviews changes to the order processing pipeline against business rules and idempotency constraints.
validate-payload
Validates incoming request payloads against JSON Schema before processing.
retry-payment
Retries failed 3DS payment with idempotent key and jitter backoff.