Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add konamgil/mandu --skill mandu-create-apigit clone --depth 1 https://github.com/konamgil/manduWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/konamgil/mandu/mandu-create-api)<a href="https://agentmods.dev/skills/konamgil/mandu/mandu-create-api"><img src="https://agentmods.dev/badge/skills/konamgil/mandu/mandu-create-api/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/konamgil/mandu/mandu-create-api"><img src="https://agentmods.dev/badge/skills/konamgil/mandu/mandu-create-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01089 |
| Opus 5.5 | $0.00013 | $0.00436 |
| Sonnet 5.5 | $0.00007 | $0.00218 |
| Haiku 4.5 | $0.00003 | $0.00109 |
Grade B, and why
mandu-create-api scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
const res = await fetch("http://localhost:3333/api/posts", { method: "POST", How it starts
The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mandu Create API
REST API 엔드포인트를 생성하는 워크플로우. Route + Contract + Slot + Test 파이프라인으로 완전한 API를 스캐폴딩합니다.
Workflow: Route -> Contract -> Slot -> Test
Step 1: Route 생성
// app/api/posts/route.ts
import { Mandu } from "@mandujs/core";
export default Mandu.filling()
.get((ctx) => ctx.ok({ posts: [] }))
.post(async (ctx) => {
const body = await ctx.body<CreatePostInput>();
return ctx.created({ post: body });
});
Step 2: Contract 정의
// src/shared/contracts/post.contract.ts
import { z } from "zod";
export const CreatePostInput = z.object({
title: z.string().min(1).max(200),
content: z.string().min(1),
tags: z.array(z.string()).optional(),
});
export const PostResponse = z.object({
id: z.string(),
title: z.string(),
content: z.string(),
createdAt: z.string().datetime(),
});
export type CreatePostInput = z.infer<typeof CreatePostInput>;
export type PostResponse = z.infer<typeof PostResponse>;
Step 3: Slot (서버 데이터 로더)
// spec/slots/posts.slot.ts
import { Mandu } from "@mandujs/core";
import { CreatePostInput } from "@/shared/contracts/post.contract";
export default Mandu.filling()
.guard(async (ctx) => {
const token = ctx.headers.get("authorization");
if (!token) return ctx.error(401, "Unauthorized");
ctx.set("userId", await verifyToken(token));
})
.post(async (ctx) => {
const body = await ctx.body<CreatePostInput>();
const validated = CreatePostInput.parse(body);
const post = await db.posts.create({ ...validated, userId: ctx.get("userId") });
return ctx.created({ post });
});
Step 4: Test 작성
// tests/api/posts.test.ts
import { describe, test, expect } from "bun:test";
describe("POST /api/posts", () => {
test("creates a post with valid input", async () => {
const res = await fetch("http://localhost:3333/api/posts", {
method: "POST",
headers: {
"Content-Type": "application/json",
Authorization: "Bearer test-token",
},
body: JSON.stringify({ title: "Test", content: "Hello" }),
});
expect(res.status).toBe(201);
const data = await res.json();
expect(data.post.title).toBe("Test");
});
test("returns 401 without auth", async () => {
const res = await fetch("http://localhost:3333/api/posts", {
method: "POST",
body: JSON.stringify({ title: "Test", content: "Hello" }),
});
expect(res.status).toBe(401);
});
});
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 152 lines · 33 tokens per session scan B ff9e3b340ee6
mandu-create-api is a skill published in the GitHub repository konamgil/mandu (47 stars, last pushed 1mo ago), licensed MPL-2.0. It adds 33 tokens to every session and 1,089 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 1 finding (sends data to an external url). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Full Stack Engineer
Full Stack Engineer delivers production-grade technical work with clear architecture, tests, maintainability, and operational awareness.
groq-inference
Ultra-fast LLM inference on custom LPU hardware. OpenAI-compatible API at api.groq.com. Lowest latency in the industry (500-1000+ tok/s). Supports chat completions, vision, audio (Whisper STT + TTS), tool calling, JSON mode, and streaming. Free tier available. Inference only — no training.
frontmcp-guides
Tutorials, end-to-end walkthroughs, and complete reference projects for FrontMCP. Use when you want a getting-started guide, a full worked example, or to learn best practices by following a step-by-step build rather than a single API reference. Includes a beginner weather-API server (tool plus static resource, Zod…
bunqueue
Use when building or operating bunqueue queues, workers, durable workflows, agent turns, MCP tools, retries, cron or dependency flows.
node-typescript-service
Use when building or extending a TypeScript service on Node.js - Fastify, NestJS, Express or Hono, runtime validation at the boundary, strict types, the repository's ORM and migrations, async error handling, graceful shutdown.
rust-axum-service
Use when building or extending a Rust service - axum on tokio (or the repository's actix-web / rocket), typed errors with IntoResponse, serde at the boundary, sqlx queries and migrations, never blocking the runtime, tracing, clippy.