Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/kvdm-co-pilot/create-cmpnpx agentmods add skills/kvdm-co-pilot/create-cmp/add-repositoryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/add-repository)<a href="https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/add-repository"><img src="https://agentmods.dev/badge/skills/kvdm-co-pilot/create-cmp/add-repository.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00161 | $0.01360 |
| Opus 5 | $0.00081 | $0.00680 |
| Sonnet 5 | $0.00032 | $0.00272 |
| Haiku 4.5 | $0.00016 | $0.00136 |
Grade A, and why
add-repository scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
add-repository — stamp a data/domain slice only
Deterministic-stamp, gate-proven. The script (
qa/scaffold-feature.mjs --preset repository) does the mechanical work — copy thehomeexemplar's data/domain files, whole-word identifier rename, DI injection for the repository + use case only. You (the AI) only customize the entity's fields and its sample data. You are not done untilnode qa/verify.mjsPASSes and the receipt is committed — see this project'sCLAUDE.md.
This is the repository subset of add-feature — same stamper, same rename mechanic, filtered
to just the 5 data/domain files. Use it when you want the data layer to exist before any screen
consumes it (e.g. you're modeling several entities up front, or a screen for this entity will
come later via add-screen).
Name the lane first, out loud. Before any tool runs, tell the human in a sentence which
lane this request takes (CLAUDE.md §"After genesis"): an entity carrying decisions worth
recording (data-model semantics, boundary rules) goes through a feature brief
(docs/features/<name>.md, signed before code); an ordinary entity is direct lane — say so,
then continue here. Never route silently.
Why a stamper and not hand-written files
Every hand-written file is a drift chance in this project's architecture. qa/scaffold-feature.mjs --preset repository produces a conforming skeleton by construction for the data/domain
layer: a domain model, a domain repository interface, a use case, a data-layer impl, and a
hand-written fake for tests — wired into Koin. Your job is to make the entity's shape and sample
data real, not to make the wiring correct — that part is already done.
The flow
1. Name the entity
Ask the human for the entity name — PascalCase, singular (e.g. Tag, Bookmark, Category).
Unlike add-feature/add-screen, there is no feature name and no --entity flag here: the
positional argument is the entity.
2. Dry-run
node qa/scaffold-feature.mjs <Entity> --preset repository --dry-run
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 113 lines · 161 tokens per session scan A 4f007c0c40d5
add-repository is a skill published in the GitHub repository kvdm-co-pilot/create-cmp (0 stars, last pushed today), licensed MIT. It adds 161 tokens to every session and 1,360 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
compose-multiplatform
Use when building one shared Compose UI in Kotlin across Android, iOS, and desktop — commonMain @Composables, expect/actual, source-set placement, native interop, multiplatform ViewModel/navigation/Koin. NOT a single-platform native build (that is kotlin-android / swift-ios), and NOT Dart/Flutter cross-platform UI…
m3-expressive
Material 3 Expressive design patterns for Jetpack Compose - expressive theming, motion physics, shape morphing, typography emphasis, color emphasis, and all 28 expressive components.
liquid-glass
Apple Liquid Glass design patterns for SwiftUI iOS 26 - glass effects, morphing, containers, interactive glass, tinting, accessibility, and cross-platform glass design.
android-device-integrity
Android app/device integrity and anti-fraud for a fintech app — the Play Integrity API (com.google.android.play:integrity): Standard requests (StandardIntegrityManager.prepareIntegrityToken → StandardIntegrityTokenProvider.request with a requestHash → StandardIntegrityToken) vs Classic requests…
mobile-session-security
KMP + iOS/Android session hardening for a fintech app — inactivity auto-lock (track last-interaction, idle timeout, biometric/passcode re-auth), biometric re-lock on background/foreground with a grace period, and screen-capture/snapshot protection. Android: WindowManager FLAGSECURE (blocks screenshots + recents…
offline-first
Offline-first architecture patterns - NetworkBoundResource, sync strategies, conflict resolution, cache invalidation, and connectivity monitoring.