Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/kora-projects/kora-skillsnpx agentmods add skills/kora-projects/kora-skills/kora-jsonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kora-projects/kora-skills/kora-json)<a href="https://agentmods.dev/skills/kora-projects/kora-skills/kora-json"><img src="https://agentmods.dev/badge/skills/kora-projects/kora-skills/kora-json.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01983 |
| Opus 5 | $0.00027 | $0.00992 |
| Sonnet 5 | $0.00011 | $0.00397 |
| Haiku 4.5 | $0.00005 | $0.00198 |
Grade A, and why
kora-json scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 223 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kora JSON — compile-time JSON processing
Kora sub-skill — obey the kora-v1 meta rules on every task: R0 ensure
.kora-agent/docs+examples are cloned · R1 read this sub-skill before writing code · R2 Kora APIs only — no Spring/Micronaut/Quarkus, no invented annotations or config keys · R3 journal any incorrect Kora usage. Add comments/Javadoc only if asked.
Kora generates JsonReader<T> / JsonWriter<T> at compile time from @Json-annotated
records (Java) or data classes (Kotlin). No reflection, no runtime mapper discovery:
an unsupported shape fails the build instead of throwing at runtime. Put @Json on the
DTO type itself, not only on the controller parameter — that lets the mapper be generated
during normal annotation processing and reused across HTTP bodies, cache values, and
Kafka payloads.
Quick Start
build.gradle (all Kora artifacts inherit their version from the kora-parent BOM —
never pin individual ru.tinkoff.kora:* versions):
dependencies {
koraBom platform("ru.tinkoff.kora:kora-parent:1.2.19")
annotationProcessor "ru.tinkoff.kora:annotation-processors" // mandatory: generates readers/writers
implementation "ru.tinkoff.kora:json-module"
}
Kotlin uses KSP instead: ksp "ru.tinkoff.kora:symbol-processors".
Wire the module into the application graph:
@KoraApp
public interface Application extends JsonModule {
static void main(String[] args) {
KoraApplication.run(ApplicationGraph::graph);
}
}
Define DTOs and a controller (adapted from kora-java-guide-json-app):
@Json
public record UserRequest(String name, String email) {}
@Json
public record UserResponse(String id, String name, String email, LocalDateTime createdAt) {}
@Component
@HttpController
public final class UserController {
private final UserService userService;
public UserController(UserService userService) {
this.userService = userService;
}
@HttpRoute(method = HttpMethod.POST, path = "/users")
@Json
public UserResponse createUser(@Json UserRequest request) {
return userService.createUser(request);
}
}
What ships with it
17 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/custom-mapper.java.template 1.8 KB
- assets/custom-mapper.kt.template 1.8 KB
- assets/dto.java.template 295 B
- assets/dto.kt.template 265 B
- assets/enum.java.template 1.1 KB
- assets/enum.kt.template 950 B
- assets/sealed-dto-impl.java.template 393 B
- assets/sealed-dto-impl.kt.template 375 B
- assets/sealed-dto.java.template 622 B
- assets/sealed-dto.kt.template 497 B
- evals/evals.json 5.2 KB
- README.md 1019 B
- references/json-best-practices.md 14 KB
- references/json-config-reference.md 6.8 KB
- references/json-custom-mapper-reference.md 13 KB
- references/json-dto-reference.md 7.3 KB
- references/json-sealed-reference.md 8.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 223 lines · 54 tokens per session scan A ce8bb9521d01
kora-json is a skill published in the GitHub repository kora-projects/kora-skills (1 stars, last pushed 7d ago), licensed Apache-2.0. It adds 54 tokens to every session and 1,983 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
migrate-intellij-util
Optimize memory usage, consistency, and performance by migrating standard Java/Kotlin classes to IntelliJ's specialized com.intellij.util implementations.
authoring-java-sdk-tasks
Writes Airflow task logic in Java, Kotlin, or any JVM language using the Airflow Java SDK. Use when the user wants to implement Airflow tasks in Java/JVM, asks about @Builder.Dag/@Builder.Task/@Builder.XCom, the Task/BundleBuilder interfaces, reading connections/variables/XComs from Java, the JSON-to-Java type…
null-safety
Use when annotating nullability in Spring Boot 3 / Spring Framework 6 code, integrating Kotlin, or adding static nullability checks without assuming Spring Framework 7 JSpecify defaults.
jackson-3-migration
Migrer Jackson 2.x til Jackson 3.x (tools.jackson) i Kotlin/Java-prosjekter — automatisert OpenRewrite-pass pluss manuell Kotlin-spesifikk opprydding og verifisering.
java-to-kotlin
Trinnvis Java-til-Kotlin-migrering med rammeverk-bevisste transformasjoner for Spring, Ktor og Nav-mønstre.
vigilante-issue-implementation-on-java-kotlin
Implement a GitHub issue end-to-end when Vigilante dispatches work for a Java or Kotlin repository with JVM build-tool, style, and secure-coding guidance.