Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/onewave-ai/open-agent-stack/make-it-realnpx skills add OneWave-AI/open-agent-stack --skill make-it-realgit clone --depth 1 https://github.com/OneWave-AI/open-agent-stackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/onewave-ai/open-agent-stack/make-it-real)<a href="https://agentmods.dev/skills/onewave-ai/open-agent-stack/make-it-real"><img src="https://agentmods.dev/badge/skills/onewave-ai/open-agent-stack/make-it-real.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00051 | $0.00600 |
| Opus 5 | $0.00026 | $0.00300 |
| Sonnet 5 | $0.00010 | $0.00120 |
| Haiku 4.5 | $0.00005 | $0.00060 |
Grade A, and why
make-it-real scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 26 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Make It Real
Every vibe-coded app hits the same wall: it looks done and does nothing. The dashboard charts a hardcoded array, the login button sets a boolean, the contact form resolves a promise into the void. This is the pass that makes the screens tell the truth.
Workflow
- Inventory the lies. Sweep the repo and list every place the UI implies something real that is not: hardcoded arrays feeding lists and charts,
useState(true)standing in for a session, form handlers with no network call,TODOnext to anything on the money path. Show the user the list before changing code -- it is usually longer than they think. - Model the data once. Before wiring anything, write the schema the app actually needs: tables, relationships, and the row-level access rule for each ("a user reads only their own rows"). Getting this wrong is the expensive mistake; getting it written down takes ten minutes.
- Wire data, one screen at a time. Typed client, real query, real loading state, real empty state, real error state. Delete the hardcoded array in the same commit that replaces it -- a fallback to fake data hides outages and lies to you later.
- Real auth, real authorization. Sign-in against an actual provider, session read server-side, and -- the step people skip -- every mutating route and every row query checks who is asking. A logged-in user is not an authorized user. Protect the API, not just the page that links to it.
- Close the loop on side effects. Forms deliver somewhere a human will see (inbox, database, notification), payments hit real objects in test mode first, and uploads land in real storage with a size and type limit. Then verify each one end to end by actually doing it and checking the other side.
Rules
- Never leave mock data behind a flag "just in case" -- if the query fails, the empty or error state is the honest UI.
- Secrets stay server-side. Anything reaching the browser is public: audit every
NEXT_PUBLIC_and every key used in a client component. - Validate input at the boundary, on the server, always -- client-side validation is a UX feature, not a security control.
- Row-level access rules belong in the database when it supports them, so a forgotten check in one route cannot leak everything.
- Migrations are files in the repo, not clicks in a dashboard, or the next environment will not match.
- Report what is now genuinely live versus still stubbed. The user should never have to guess which screens are real.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 26 lines · 51 tokens per session scan A 3b40d7653381
make-it-real is a skill published in the GitHub repository OneWave-AI/open-agent-stack (2 stars, last pushed 24d ago), licensed MIT. It adds 51 tokens to every session and 600 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
prisma-driver-adapter-implementation
Required reference for Prisma v7 driver adapter work. Use when implementing or modifying adapters, adding database drivers, or touching SqlDriverAdapter/Transaction interfaces. Contains critical contract details not inferable from code examples — including the transaction lifecycle protocol, error mapping…
prisma-compute
Prisma Compute deployment and hosting guide. Use whenever the user mentions Prisma Compute, prisma.compute.ts, defineComputeConfig, deploying or hosting a Prisma app, @prisma/cli app deploy, compute:deploy, create-prisma --deploy, PRISMASERVICETOKEN, auth workspace, Compute apps/deployments/build logs/domains…
prisma-postgres-setup
Set up a new Prisma Postgres database and connect it to a local project using the Management API. Use when asked to "set up a database", "create a Prisma Postgres project", "get a connection string", "connect my app to Prisma Postgres", or "provision a database".
prisma-upgrade-v7
Complete migration guide from Prisma ORM v6 to v7 covering all breaking changes. Use when upgrading Prisma versions, encountering v7 errors, or migrating existing projects. Triggers on "upgrade to prisma 7", "prisma 7 migration", "prisma-client generator", "driver adapter required".
prisma-cli
Prisma ORM CLI commands reference covering init, generate, migrate, db, dev, studio, validate, format, debug, and mcp. Use for ORM/database CLI workflows, not Prisma Compute app deployment. For Prisma Compute, @prisma/cli app deploy, compute:deploy, create-prisma --deploy, apps, deployments, logs, or domains, use the…
prisma-client-api
Prisma Client API reference covering model queries, filters, operators, and client methods. Use when writing database queries, using CRUD operations, filtering data, or configuring Prisma Client. Triggers on "prisma query", "findMany", "create", "update", "delete", "$transaction".