Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/rome-os/romenpx agentmods add skills/rome-os/rome/app_creationWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rome-os/rome/app_creation)<a href="https://agentmods.dev/skills/rome-os/rome/app_creation"><img src="https://agentmods.dev/badge/skills/rome-os/rome/app_creation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rome-os/rome/app_creation"><img src="https://agentmods.dev/badge/skills/rome-os/rome/app_creation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 3 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.02959 |
| Opus 5.5 | $0.00000 | $0.01184 |
| Sonnet 5.5 | $0.00000 | $0.00592 |
| Haiku 4.5 | $0.00000 | $0.00296 |
Grade A, and why
app_creation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
App Creation
Takes the agent from "I want to build app X" to "a permanent git-versioned working tree exists at $REPO and the daemon is reading from it." Once that's true, hand control to AUTHORING.md for the edit → commit → install loop.
First: is this an app, or a workflow?
Most "build me something that does X" requests are workflows, not apps. Apply this litmus before scaffolding:
A workflow takes inputs, runs a sequence (transform, call actions, use
system:summonfor an LLM step), and returns a result — summaries, digests, drafting/writing, triage, monitor-and-notify, multi-source synthesis, "do X when Y". This is the default — including when the user wants to run it repeatedly and review past runs (the platform persists run history for free; authors never build that).Scaffold a full app only if at least one is true:
- It owns a data model the user edits — records they create / update / delete and return to (tracker, CRM, library, kanban). Wanting to see past runs does not count — that's free platform history, not a custom data model.
- It has more than one distinct operation — several verbs the user chooses between (add, browse, configure, approve…), not just "run it". A single trigger, even with inputs, is still a workflow.
- It has a conversational or long-lived agent — something the user talks to, or that carries memory/its own tools across turns. A one-shot "generate X from Y" is a
system:summonstep, not an agent.None of those → STOP and use
coding:workflow_creationinstead. Two smells that you've mis-split a pipeline into an app: reaching for adb:section to store past outputs, or standing up a custom agent for a one-shot generation. A workflow is a verb (do this, give me the result); an app is a noun (a place that holds my stuff).
If — and only if — the litmus says app, continue.
Invariants this skill enforces
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +2 lines 89ca626ebe96
- 9d ago Changed 5b79d0fd6d37
- 10d ago Changed · +4 lines 312d997948f6
- 1mo ago Changed · +7 lines 13f35174df5b
- 1mo ago First seen · 119 lines · 0 tokens per session scan A f07ac7b43674
app_creation is a skill published in the GitHub repository rome-os/rome (835 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,959 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
aos-router
Route one inbound user message to exactly one enabled AOS capability. This skill is a strategy contract only. Transport normalization, queueing, permissions, idempotency, audit events, retries, and capability execution stay in Rust.
code-studio-spec
Kiro-style Spec Mode for Code Studio: requirements, design, tasks, implementation, verification, and final report. Runtime sessions, candidate workspaces, diff approval, tests, and cancellation stay in Rust.
watchdog
Parse natural-language WatchDog questions into structured AgentOps queries. This skill documents the intent contract. Rust rules, permission checks, action guards, and fallback answers remain authoritative.
code-studio-code
Cursor/Codex-style coding workspace contract for ordinary Code Mode. This skill documents the behavior expected from the coding agent. Runtime sessions, workspace isolation, process execution, diff validation, and apply/reject actions stay in Rust.
nl2sql-reference
Strategy contract for user-bound reference files in Data Exploration. References can be README files, SQL demos, Python scripts, notebooks exported as text, metric dictionaries, or any UTF-8 text that explains business query patterns. Storage, upload validation, SQL safety, datasource permissions, and query execution…
pm-assistant
Product operations assistant strategy contract. PM short answers and deep analysis should be evidence-grounded and should separate facts from hypotheses. Model calls, hooks, queueing, cancellation, notifications, and staged task execution stay in Rust.