Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pinebasedev/svelteflare/formsnpx skills add pinebasedev/svelteflare --skill formsgit clone --depth 1 https://github.com/pinebasedev/svelteflareWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00155 | $0.02081 |
| Opus 5 | $0.00077 | $0.01040 |
| Sonnet 5 | $0.00031 | $0.00416 |
| Haiku 4.5 | $0.00015 | $0.00208 |
Grade A, and why
forms scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Forms
All forms in this project use sveltekit-superforms + FormSnap + Zod v4 in SPA mode (no server-side form actions — everything is client-side). The app has ssr = false.
Full pattern
1. Zod schema — apps/web/src/lib/forms/<name>-schema.ts
import z from 'zod';
export const profileFormSchema = z.object({
name: z
.string()
.min(2, { message: 'Name must be at least 2 characters.' })
.max(50, { message: 'Name must be under 50 characters.' })
.trim(),
email: z.email({ message: 'Please enter a valid email address.' }).trim(),
bio: z.string().max(500, { message: 'Bio must be under 500 characters.' }).optional()
});
export type ProfileFormSchema = typeof profileFormSchema;
Use z.email() (not z.string().email()) — this project runs Zod v4. Cross-field validation uses .refine():
export const changePasswordSchema = z
.object({
password: z.string().min(8),
confirmPassword: z.string()
})
.refine((d) => d.password === d.confirmPassword, {
message: "Passwords don't match.",
path: ['confirmPassword']
});
2. Page component — +page.svelte
<script lang="ts">
import { apiFetch } from '$lib/api';
import { profileFormSchema } from '$lib/forms/profile-schema';
import { Button, Form, Input } from '@repo/ui';
import { toast } from 'svelte-sonner';
import { defaults, superForm } from 'sveltekit-superforms';
import { zod4, zod4Client } from 'sveltekit-superforms/adapters';
const initialData = { name: '', email: '', bio: '' };
const form = superForm(defaults(initialData, zod4(profileFormSchema)), {
SPA: true,
validators: zod4Client(profileFormSchema),
validationMethod: 'onsubmit', // validate on blur for better UX on longer forms
async onUpdate({ form }) {
if (!form.valid) return;
try {
const { error } = await apiFetch('/v1/profile', {
method: 'PUT',
body: form.data
});
if (error) {
toast.error(error.message ?? 'Could not save profile. Please try again.');
return;
}
toast.success('Profile updated.');
} catch {
toast.error('Could not save profile. Please try again.');
}
}
});
const { form: formData, enhance, submitting } = form;
</script>
<form method="POST" use:enhance>
<Form.Field {form} name="name">
<Form.Control>
{#snippet children({ props })}
<Form.Label>Name</Form.Label>
<Input.Root bind:value={$formData.name} type="text" {...props} class="text-base" />
{/snippet}
</Form.Control>
<Form.FieldErrors />
</Form.Field>
<Form.Field {form} name="email">
<Form.Control>
{#snippet children({ props })}
<Form.Label>Email</Form.Label>
<Input.Root bind:value={$formData.email} type="email" {...props} class="text-base" />
{/snippet}
</Form.Control>
<Form.FieldErrors />
</Form.Field>
<Button.Root type="submit" class="w-full" disabled={$submitting}>
{$submitting ? 'Saving...' : 'Save changes'}
</Button.Root>
</form>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 243 lines · 155 tokens per session scan A 53cad6083bd1
forms is a skill published in the GitHub repository pinebasedev/svelteflare (49 stars, last pushed 1mo ago), licensed MIT. It adds 155 tokens to every session and 2,081 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
changelog-writer
This skill should be used when the user asks to "add a changelog entry", "write changelog", "audit changelog", "review changelog", "check changelog entries", or is editing docs-mintlify/changelog.mdx. Enforces a consistent, reader-facing voice and cuts implementation trivia.
add-media
This skill should be used when the user asks to "add a movie", "add a vinyl", "add to my collection", "add physical media", "add a Blu-ray", "add a CD", or "bought these records". It handles both movies (via TMDb/Trakt) and music (via Discogs).
media-search
This skill should be used when the user asks to "search for a movie", "find a record on Discogs", "look up a film", "search TMDb", "search Discogs", "what's the TMDb ID for", "what's the Discogs ID for", or wants to look up media metadata before adding it to the collection.
multiworker-gotchas
Fork and template gotchas (env import, routes, typegen, forms, D1, Turbo, HMR, new DO packages). Use when working on apps/web or durable-objects, or when behavior diverges from this stack’s conventions.
multiworker-workflow
Repo-root commands, typegen and typecheck cadence, lint, deploy, adding packages with bun, and Alchemy app layout. Use at the start of a task, before PR, or when choosing turbo/typegen commands.
turborepo
Turborepo task configuration patterns for monorepo management. Use when configuring turbo.json tasks, setting up task dependencies, managing cache inputs/outputs, or working with cross-package dependencies in the monorepo.