Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lukasrepublic/agentic-foundry --skill legacy-app-containerizegit clone --depth 1 https://github.com/lukasrepublic/agentic-foundryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lukasrepublic/agentic-foundry/legacy-app-containerize)<a href="https://agentmods.dev/skills/lukasrepublic/agentic-foundry/legacy-app-containerize"><img src="https://agentmods.dev/badge/skills/lukasrepublic/agentic-foundry/legacy-app-containerize.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01063 |
| Opus 5 | $0.00000 | $0.00531 |
| Sonnet 5 | $0.00000 | $0.00213 |
| Haiku 4.5 | $0.00000 | $0.00106 |
Grade A, and why
legacy-app-containerize scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When to trigger
- Containerizing an application pinned to an end-of-life runtime major (old Node.js/Python/Ruby) as-is for a lift-and-shift migration (runtime upgrade is a separate project).
- A legacy-app image build failing with parser errors in
.d.tsfiles, engine-floor install errors, "no rule to make target" in a post-install hook, EACCES on first write, or a BuildKit GOAWAY during export.
Inputs: source repo; the pinned runtime + major (e.g. node:16.20.1); package manager + install
verb; the non-root runtime UID; runtime state paths; the registry immutability policy (tag == SHA).
Pre-flight checks (run BEFORE the first build; each maps to a fleet-recurrent gotcha)
lockfile-committed— a lockfile exists AND is committed. Install-at-build with no lockfile carries a latent transitive-version float: the image builds today and hard-breaks on the next rebuild when a^-ranged transitive floats. When the manifest and lockfile are OUT OF SYNC, make a surgical single-entry lockfile edit of only the drifted entry (when the two versions have identical dependency trees) — never a fresh install, which re-floats every transitive dep and reintroduces the stub-float and engine-floor gotchas.type-stub-pinned-to-runtime— pin@types/<runtime>-style stubs to the RUNTIME's major (e.g.^16stubs for a v16 runtime). An unpinned stub floats to a modern major whose.d.tsuses syntax the old compiler's PARSER rejects (parse errors, not type errors) — and--skipLibCheckdoes NOT rescue it: it skips.d.tstype-CHECKING but still PARSES every.d.ts.engine-floor-vs-runtime— scan the resolved tree forenginesfloors above the pinned runtime. A strict/frozen install ERRORS on the mismatch (the legacy environment only warned). Prescribe the ignore-engines flag while keeping the lockfile frozen, and track the EOL runtime as a pre-production residual — never unfreeze to dodge the error.build-file-in-deps-layer— a post-install/native hook's referenced files are in the dependency-layer COPY set. A hook runningmake …during install fails "no rule to make target" when the deps layer COPYed only manifest + lockfile + registry config — layer-ordering correctness, not a toolchain bug.workdir-writable-for-nonroot— if the app writes runtime state under WORKDIR and runs non-root,chownthe state path for the runtime UID — a root-owned WORKDIR gives EACCES on the first write of a file-backed embedded store.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 66 lines · 0 tokens per session scan A aa81bee6c4e9
legacy-app-containerize is a skill published in the GitHub repository lukasrepublic/agentic-foundry (1 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,063 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
scaffold
Bootstrap a new project with your stack, auth, database, and standards pre-configured.
local-env-orchestration
Orchestrates local Kubernetes development environment management.
memstack-deployment-docker-setup
Use this skill when the user says 'Docker', 'Dockerfile', 'docker-compose', 'containerize', 'docker-setup', or needs to containerize an application with optimized Docker images and compose configurations. Do NOT use for serverless or static site deployments.
spawn-reviewers
Spawn and collect the reviewer fleet at stage20spawnreviewers. Consumes spawn.json.spec (the authoritative spawn spec from derive-spawn-spec / derive-static-spec), resolves GRAPHPROJECT, builds per-agent prompts from the per-agent template + role suffixes (Bug Hunter A/B, Unified Auditor, Domain Critics, Impact…
software-paas-hosting
Chooses PaaS compute hosting for apps, agents, bots, APIs, and workers. Use when picking Vercel, Fly.io, Railway, Render, Cloudflare, Deno, or container PaaS.
verify-findings
Dispatch and collect the finding-verifier fleet at stage23verifyfindings (PLN-722). Reads verifymanifest.json (written by stage22bverifyprepare), spawns one falsify-oriented verifier Task per toverify[] entry with mode-specific Task scheduling (GitHub mode dispatches verifiers synchronously; local mode uses parallel…