Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nifrajs/nifra --skill nifra-webgit clone --depth 1 https://github.com/nifrajs/nifraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nifrajs/nifra/nifra-web)<a href="https://agentmods.dev/skills/nifrajs/nifra/nifra-web"><img src="https://agentmods.dev/badge/skills/nifrajs/nifra/nifra-web/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nifrajs/nifra/nifra-web"><img src="https://agentmods.dev/badge/skills/nifrajs/nifra/nifra-web.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.01084 |
| Opus 5 | $0.00043 | $0.00542 |
| Sonnet 5 | $0.00017 | $0.00217 |
| Haiku 4.5 | $0.00009 | $0.00108 |
Grade A, and why
nifra-web scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Nifra: full-stack rendering
@nifrajs/web is the framework-agnostic SSR core; @nifrajs/web-react, -vue, -solid,
-svelte, and -preact are render adapters over the same routing, loaders, streaming, and islands.
Switching UI library is an adapter import, not a rewrite.
Call nifra_context first in an existing app: it returns the actual route tree and conventions, which
beats inferring them from a directory listing.
Data flows one way
route file -> loader (server) -> component (server render, then hydrate) -> action (server) -> revalidate
- Loader - runs on the server for the matched route. Returns typed data to the component. Reach
your own API through
ctx.api(an in-process client - no HTTP hop, no base URL, no auth replay). - Action - handles a mutation, then revalidation refreshes the loaders that matter.
- Component - renders on the server, then hydrates. It must be safe to run in both places.
Do not fetch() your own backend from a loader. ctx.api is the in-process path and it is typed.
The boundary is enforced, not advisory
A server-only module that reaches the browser bundle is a build error. That is deliberate: leaking a DB client or a secret into client JS is the failure mode this prevents.
Signals and their causes:
| Error | Cause |
|---|---|
... reached the client bundle |
A node: or native import pulled in from a component or route module |
server-only module reached the client bundle |
A module carrying the server-only marker was imported from client code |
resolveDispatcher / Invalid hook call |
Two copies of the UI framework. The adapter dedupes it at build time - a stale dist/ or a second install is the usual source |
Fixes: move the server work into a loader, an action, or a server function; keep secrets in modules the client never imports; rebuild before blaming the code.
Server functions are the escape hatch that stays safe: write the function on the server, call it from a component. The module body never ships, the arguments are validated, and the mounted function is an ordinary route - so assurance, capabilities, and the effect ledger still apply to it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 94 lines · 85 tokens per session scan A cabb89696f93
nifra-web is a skill published in the GitHub repository nifrajs/nifra (3 stars, last pushed 7d ago), licensed MIT. It adds 85 tokens to every session and 1,084 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
astro
Build content-focused websites with Astro — zero JS by default, islands architecture, multi-framework components, and Markdown/MDX support.
tauri-django-react
Agents should invoke this skill for Tauri + Django + React desktop apps, especially backend lifecycle, CORS/auth, frontend integration, mandatory light/dark theming, German/English i18n, build packaging, dual desktop/web deployment, Rust commands, and platform-specific gotchas.
inertia-rails-setup
One-time project initializer for Inertia Rails skills. Detects stack and frontend framework (React/Vue/Svelte) from Gemfile and package.json, offers to install recommended deps (alba-inertia, js-routes, pagy, shadcn), and generates a CLAUDE.md section that configures which skill patterns apply. Use when first…
veryfront
Build Veryfront apps. Use for real-time errors, route preview, HMR control, and scaffolding pages/APIs/components/AI tools.
framework-expert
Unified framework expertise bundle. Lazy-loads relevant framework patterns (React, Vue, Angular, Next.js, Node.js, Python, Laravel, Go, Flutter, React Native, TypeScript) based on detected tech stack.
nextjs-expert
Expert knowledge in Next.js framework, Server-Side Rendering, Static Site Generation, App Router, Server Components, and full-stack React applications. Use when the user mentions React, SSR, SSG, the App Router, React Server Components, or full stack, or when the task involves Next.js Fundamentals, App Router…