Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nifrajs/nifra --skill nifra-webgit clone --depth 1 https://github.com/nifrajs/nifraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nifrajs/nifra/nifra-web)<a href="https://agentmods.dev/skills/nifrajs/nifra/nifra-web"><img src="https://agentmods.dev/badge/skills/nifrajs/nifra/nifra-web/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nifrajs/nifra/nifra-web"><img src="https://agentmods.dev/badge/skills/nifrajs/nifra/nifra-web.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.01084 |
| Opus 5.5 | $0.00034 | $0.00434 |
| Sonnet 5.5 | $0.00017 | $0.00217 |
| Haiku 4.5 | $0.00009 | $0.00108 |
Grade A, and why
nifra-web scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Nifra: full-stack rendering
@nifrajs/web is the framework-agnostic SSR core; @nifrajs/web-react, -vue, -solid,
-svelte, and -preact are render adapters over the same routing, loaders, streaming, and islands.
Switching UI library is an adapter import, not a rewrite.
Call nifra_context first in an existing app: it returns the actual route tree and conventions, which
beats inferring them from a directory listing.
Data flows one way
route file -> loader (server) -> component (server render, then hydrate) -> action (server) -> revalidate
- Loader - runs on the server for the matched route. Returns typed data to the component. Reach
your own API through
ctx.api(an in-process client - no HTTP hop, no base URL, no auth replay). - Action - handles a mutation, then revalidation refreshes the loaders that matter.
- Component - renders on the server, then hydrates. It must be safe to run in both places.
Do not fetch() your own backend from a loader. ctx.api is the in-process path and it is typed.
The boundary is enforced, not advisory
A server-only module that reaches the browser bundle is a build error. That is deliberate: leaking a DB client or a secret into client JS is the failure mode this prevents.
Signals and their causes:
| Error | Cause |
|---|---|
... reached the client bundle |
A node: or native import pulled in from a component or route module |
server-only module reached the client bundle |
A module carrying the server-only marker was imported from client code |
resolveDispatcher / Invalid hook call |
Two copies of the UI framework. The adapter dedupes it at build time - a stale dist/ or a second install is the usual source |
Fixes: move the server work into a loader, an action, or a server function; keep secrets in modules the client never imports; rebuild before blaming the code.
Server functions are the escape hatch that stays safe: write the function on the server, call it from a component. The module body never ships, the arguments are validated, and the mounted function is an ordinary route - so assurance, capabilities, and the effect ledger still apply to it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 94 lines · 85 tokens per session scan A cabb89696f93
nifra-web is a skill published in the GitHub repository nifrajs/nifra (6 stars, last pushed today), licensed MIT. It adds 85 tokens to every session and 1,084 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
astro
Build content-focused websites with Astro — zero JS by default, islands architecture, multi-framework components, and Markdown/MDX support.
tauri-django-react
Agents should invoke this skill for Tauri + Django + React desktop apps, especially backend lifecycle, CORS/auth, frontend integration, mandatory light/dark theming, German/English i18n, build packaging, dual desktop/web deployment, Rust commands, and platform-specific gotchas.
vibe-coding
Use when a request needs a real code project with a toolchain, such as a React, Vue, or Vite frontend, a backend service (FastAPI, Flask, Express, Django), a compiled language project, or cloning and modifying an existing repository. Also use before running npm install, pnpm install, yarn, pip install, uv sync, poetry…
evjs
Develop, migrate, review, document, or debug evjs applications and framework code involving file-based pages, ev.config.ts, server functions, API routes, rendering, plugins, development, builds, and deployment.
veryfront
Build Veryfront apps. Use for real-time errors, route preview, HMR control, and scaffolding pages/APIs/components/AI tools.
framework-expert
Unified framework expertise bundle. Lazy-loads relevant framework patterns (React, Vue, Angular, Next.js, Node.js, Python, Laravel, Go, Flutter, React Native, TypeScript) based on detected tech stack.