Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lukedj78/dev-flow --skill data-fetchinggit clone --depth 1 https://github.com/lukedj78/dev-flowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lukedj78/dev-flow/data-fetching)<a href="https://agentmods.dev/skills/lukedj78/dev-flow/data-fetching"><img src="https://agentmods.dev/badge/skills/lukedj78/dev-flow/data-fetching/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lukedj78/dev-flow/data-fetching"><img src="https://agentmods.dev/badge/skills/lukedj78/dev-flow/data-fetching.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 8 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
- medium MCP Rug Pull · line 333 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00215 | $0.07542 |
| Opus 5.5 | $0.00086 | $0.03017 |
| Sonnet 5.5 | $0.00043 | $0.01508 |
| Haiku 4.5 | $0.00021 | $0.00754 |
Grade A, and why
data-fetching scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 445 lines — stays where its author put it; the contents beside it link to each section on GitHub.
data-fetching — Server Components first, never useEffect for reads
This skill governs where data reads land in a Next.js 16 App Router app. The framework lets you call a "use server" function from a Client Component — that's a capability, not a license. Reading data via a Server Action in useEffect costs you SSR, streaming, request deduping, caching, and parallelism. The bug is silent: no error, no warning, just worse UX and wasted POSTs.
When this skill applies
- The user is about to call a Server Action from a Client Component to load data.
- The user is about to add
useEffect(at all — but especially to fetch). - The user pastes
"use client" + useState + useEffect + fetch/getXand asks for review. - The user is about to convert a page to
"use client"so it can host filter/tab state. - The user adds a
"use server"function whose only job isSELECT/ read. - The user asks to audit a Next.js codebase against the data-fetching rules.
Contract
Follows the dev-flow contract — see references/contracts.md. Key facts:
- Reads
meta.json#stack.frameworkandstack.nextjs_version. Forframework = "monorepo", readsstack.monorepo.web.frameworkandstack.monorepo.web.nextjs_version. - Refuses to apply if:
stack.framework ∉ {"next", "monorepo"}— Server Components / Server Actions don't exist on RN, Remix, SvelteKit, Astro, plain React, etc.stack.nextjs_version != "16"—searchParamsis async in 16 (was sync in 15),revalidatePathimport path moved,refresh()fromnext/cacheis new. Do not silently translate the rules.- The project uses Pages Router (
pages/directory). Different mental model (getServerSideProps/getStaticProps/ API routes / SWR) — refuse rather than translate.
- Appends a
historyentry per refactor. - Does not bump
phase.
Companion skills
state-discipline(sibling in dev-flow) — owns the broader React-side rule (never bareuseEffect; derive state, use a query lib, use event handlers,keyto reset,useMountEffectfor one-time external sync). Install and follow it alongside this skill.forms— for any UI that persists field values to the backend. Forms are mutation-heavy and have their own toolkit; reads inside a form (e.g. preloading the entity to edit) follow this skill's rules.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +4 lines a8d5930c2952
- 1mo ago Changed 2e80310a9ea5
- 1mo ago First seen · 441 lines · 215 tokens per session scan A fe801549b616
data-fetching is a skill published in the GitHub repository lukedj78/dev-flow (6 stars, last pushed 5d ago), licensed MIT. It adds 215 tokens to every session and 7,542 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sdlc-regulatory
AI-driven SDLC governance framework with quality gates, risk-based autonomy caps, change traceability, Definition of Done, and a compliance crosswalk (EU AI Act, NIST AI RMF, ISO/IEC 42001, SOC 2, GDPR). Use when running or reviewing work through the BMad-style subagent SDLC, enforcing gates, classifying risk, or…
senior-bitcoin-auditor
Provides senior-level security auditing guidance for Bitcoin smart contracts including Taproot/Script, PSBT, UTXO management, Lightning Network, DLCs, and Bitcoin L2 protocols. Use when auditing Bitcoin contract code, PSBT builders, settlement engines, Lightning integrations, or ordinal/BRC-20 logic.
data-engineer
Data Engineering Lead — builds reliable, maintainable data pipelines, enforces data quality, and designs schemas that evolve safely.
archivarius
Data Organization Architect — designs and maintains well-structured, discoverable, and maintainable information architectures for codebases, documentation, and knowledge bases.
senior-solidity-auditor
Provides senior-level smart contract security auditing guidance for Solidity/EVM including vulnerability patterns, formal verification, gas optimization, and audit methodology.
senior-qa
Provides senior-level QA engineering guidance including test strategy, automation architecture, CI/CD integration, quality gates, and testing best practices for web, mobile, and API layers.