forms

A form-building guide for a SvelteKit application that uses Zod to validate input and client-side form helpers to manage fields and submission.

In plain words
What is it for?
Use it to build login, settings, profile, onboarding, multi-step, and other forms with field validation and submission handling.
Why use it?
It gives forms a consistent way to check user input and report validation errors without server-side form actions.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/pinebasedev/svelteflare/forms
Any agent
npx skills add pinebasedev/svelteflare --skill forms
Clone the repo
git clone --depth 1 https://github.com/pinebasedev/svelteflare

Made for: Claude Code, Codex.

Per session 155 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,081 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00155 $0.02081
Opus 5 $0.00077 $0.01040
Sonnet 5 $0.00031 $0.00416
Haiku 4.5 $0.00015 $0.00208

Measured 2d ago against content hash 53cad6083bd1, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

forms scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/forms/SKILL.md · 243 lines

How it starts

The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Forms

All forms in this project use sveltekit-superforms + FormSnap + Zod v4 in SPA mode (no server-side form actions — everything is client-side). The app has ssr = false.

Full pattern

1. Zod schema — apps/web/src/lib/forms/<name>-schema.ts

import z from 'zod';

export const profileFormSchema = z.object({
  name: z
    .string()
    .min(2, { message: 'Name must be at least 2 characters.' })
    .max(50, { message: 'Name must be under 50 characters.' })
    .trim(),
  email: z.email({ message: 'Please enter a valid email address.' }).trim(),
  bio: z.string().max(500, { message: 'Bio must be under 500 characters.' }).optional()
});

export type ProfileFormSchema = typeof profileFormSchema;

Use z.email() (not z.string().email()) — this project runs Zod v4. Cross-field validation uses .refine():

export const changePasswordSchema = z
  .object({
    password: z.string().min(8),
    confirmPassword: z.string()
  })
  .refine((d) => d.password === d.confirmPassword, {
    message: "Passwords don't match.",
    path: ['confirmPassword']
  });

2. Page component — +page.svelte

<script lang="ts">
  import { apiFetch } from '$lib/api';
  import { profileFormSchema } from '$lib/forms/profile-schema';
  import { Button, Form, Input } from '@repo/ui';
  import { toast } from 'svelte-sonner';
  import { defaults, superForm } from 'sveltekit-superforms';
  import { zod4, zod4Client } from 'sveltekit-superforms/adapters';

  const initialData = { name: '', email: '', bio: '' };

  const form = superForm(defaults(initialData, zod4(profileFormSchema)), {
    SPA: true,
    validators: zod4Client(profileFormSchema),
    validationMethod: 'onsubmit',   // validate on blur for better UX on longer forms
    async onUpdate({ form }) {
      if (!form.valid) return;

      try {
        const { error } = await apiFetch('/v1/profile', {
          method: 'PUT',
          body: form.data
        });

        if (error) {
          toast.error(error.message ?? 'Could not save profile. Please try again.');
          return;
        }

        toast.success('Profile updated.');
      } catch {
        toast.error('Could not save profile. Please try again.');
      }
    }
  });

  const { form: formData, enhance, submitting } = form;
</script>

<form method="POST" use:enhance>
  <Form.Field {form} name="name">
    <Form.Control>
      {#snippet children({ props })}
        <Form.Label>Name</Form.Label>
        <Input.Root bind:value={$formData.name} type="text" {...props} class="text-base" />
      {/snippet}
    </Form.Control>
    <Form.FieldErrors />
  </Form.Field>

  <Form.Field {form} name="email">
    <Form.Control>
      {#snippet children({ props })}
        <Form.Label>Email</Form.Label>
        <Input.Root bind:value={$formData.email} type="email" {...props} class="text-base" />
      {/snippet}
    </Form.Control>
    <Form.FieldErrors />
  </Form.Field>

  <Button.Root type="submit" class="w-full" disabled={$submitting}>
    {$submitting ? 'Saving...' : 'Save changes'}
  </Button.Root>
</form>

Read the full file on GitHub · 243 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 243 lines · 155 tokens per session scan A 53cad6083bd1

Subscribe to this mod's changes

forms is a skill published in the GitHub repository pinebasedev/svelteflare (49 stars, last pushed 1mo ago), licensed MIT. It adds 155 tokens to every session and 2,081 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

changelog-writer

This skill should be used when the user asks to "add a changelog entry", "write changelog", "audit changelog", "review changelog", "check changelog entries", or is editing docs-mintlify/changelog.mdx. Enforces a consistent, reader-facing voice and cuts implementation trivia.

pdugan20/rewind · 68 tokens

add-media

This skill should be used when the user asks to "add a movie", "add a vinyl", "add to my collection", "add physical media", "add a Blu-ray", "add a CD", or "bought these records". It handles both movies (via TMDb/Trakt) and music (via Discogs).

pdugan20/rewind · 71 tokens

media-search

This skill should be used when the user asks to "search for a movie", "find a record on Discogs", "look up a film", "search TMDb", "search Discogs", "what's the TMDb ID for", "what's the Discogs ID for", or wants to look up media metadata before adding it to the collection.

pdugan20/rewind · 75 tokens

multiworker-gotchas

Fork and template gotchas (env import, routes, typegen, forms, D1, Turbo, HMR, new DO packages). Use when working on apps/web or durable-objects, or when behavior diverges from this stack’s conventions.

firtoz/cf-multiworker-starter-kit · 56 tokens

multiworker-workflow

Repo-root commands, typegen and typecheck cadence, lint, deploy, adding packages with bun, and Alchemy app layout. Use at the start of a task, before PR, or when choosing turbo/typegen commands.

firtoz/cf-multiworker-starter-kit · 50 tokens

turborepo

Turborepo task configuration patterns for monorepo management. Use when configuring turbo.json tasks, setting up task dependencies, managing cache inputs/outputs, or working with cross-package dependencies in the monorepo.

firtoz/cf-multiworker-starter-kit · 48 tokens