Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/rootstrap/rails_api_base/rails-conventionsnpx skills add rootstrap/rails_api_base --skill rails-conventionsgit clone --depth 1 https://github.com/rootstrap/rails_api_baseWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00071 | $0.01868 |
| Opus 5 | $0.00036 | $0.00934 |
| Sonnet 5 | $0.00014 | $0.00374 |
| Haiku 4.5 | $0.00007 | $0.00187 |
Grade A, and why
rails-conventions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 156 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Rails Conventions (Rootstrap)
Apply these whenever producing or modifying Rails-specific code. Full guide: https://github.com/rootstrap/tech-guides/blob/master/ruby/rails.md
Complements ruby-conventions (language-level style still applies).
Configuration
- Custom initialization in
config/initializers; one file per gem, named after the gem (e.g.carrierwave.rb). - Environment-specific settings in
config/environments/; shared settings inconfig/application.rb. - Create a
stagingenvironment that mirrors production. - Extra YAML config under
config/, loaded viaRails::Application.config_for(:yaml_file). - Append non-default assets to
config.assets.precompileinproduction.rb(e.g. admin CSS/JS).application.*and non-JS/CSS assets are already included.
Routing
- Prefer
resourcesover custom routes; use:only/:exceptto limit routes.# bad get 'topics/:id', to: 'topics#show' # good resources :topics, only: :show member/collectionfor extra RESTful actions; use block form when many.- Express associations with nested routes; use
shallow: truebeyond 1 level deep. namespaceto group related actions (e.g.admin).- Never use the wildcard
match ':controller(/:action(/:id(.:format)))'route. - Avoid
matchunless mapping multiple HTTP verbs via:via.
Controllers
- Keep controllers skinny — no business logic (belongs in models/services).
- Each action should ideally call only one method beyond an initial
find/new. - Share at most two instance variables between controller and view.
Rendering
- Prefer templates/partials over
render inline:. render plain:overrender text:.- Use HTTP status symbols, not numbers.
# bad render status: 500 # good render status: :forbidden
Models
- Introduce non-ActiveRecord model classes freely; short, meaningful names.
- Use ActiveAttr gem for non-persisted models needing AR-like behavior.
- Keep models for business logic/persistence; move formatting/HTML concerns to decorators.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 156 lines · 71 tokens per session scan A 12abf296108e
rails-conventions is a skill published in the GitHub repository rootstrap/rails_api_base (631 stars, last pushed 4d ago), licensed MIT. It adds 71 tokens to every session and 1,868 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rails-upgrade
Analyzes Rails applications and generates comprehensive upgrade reports with breaking changes, deprecations, and step-by-step migration guides for Rails 2.3 through 8.1. Use when upgrading Rails applications, planning multi-hop upgrades, or querying version-specific changes. Based on FastRuby.io methodology and "The…
nextjs-pages-router
Set up tRPC in Next.js Pages Router with createNextApiHandler, createTRPCNext, withTRPC HOC, SSR via ssr option and ssrPrepass, SSG via createServerSideHelpers with getStaticProps, and server-side helpers for getServerSideProps prefetching.
non-json-content-types
Handle FormData, file uploads, Blob, Uint8Array, and ReadableStream inputs in tRPC mutations. Use octetInputParser from @trpc/server/http for binary data. Route non-JSON requests with splitLink and isNonJsonSerializable() from @trpc/client. FormData and binary inputs only work with mutations (POST).
scalar-docs
Skill for writing and updating scalar.config.json — Scalar Docs configuration reference for users and LLMs.
saas-builder
Clone, verify, map, and build on top of ixartz/SaaS-Boilerplate for a user's SaaS idea. Use when a user wants to reuse SaaS Boilerplate, evaluate how their product fits it, or build product-specific pages, database schema, roles, permissions, MVP features, and launch scope on top of the boilerplate.
horse-integration-tests
Guide for writing automated integration tests for Horse endpoints using DUnit/DUnitX and THTTPClient.