Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add saeedkolivand/ai-job-hunter-app --skill tauri-standardsgit clone --depth 1 https://github.com/saeedkolivand/ai-job-hunter-appWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/saeedkolivand/ai-job-hunter-app/tauri-standards)<a href="https://agentmods.dev/skills/saeedkolivand/ai-job-hunter-app/tauri-standards"><img src="https://agentmods.dev/badge/skills/saeedkolivand/ai-job-hunter-app/tauri-standards/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/saeedkolivand/ai-job-hunter-app/tauri-standards"><img src="https://agentmods.dev/badge/skills/saeedkolivand/ai-job-hunter-app/tauri-standards.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.00865 |
| Opus 5 | $0.00023 | $0.00432 |
| Sonnet 5 | $0.00009 | $0.00173 |
| Haiku 4.5 | $0.00005 | $0.00086 |
Grade A, and why
tauri-standards scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 45 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tauri / IPC standards
New IPC capability — 5 files, in order
packages/shared/src/ipc/contracts/— add the typed signature (Zod schema) in a new/existing contract file.apps/desktop/src-tauri/src/commands/— implement the Tauri command (typedAppResult, noResult<_,String>).apps/desktop/src/tauri-client/index.ts— wire theinvokecall.apps/desktop/src/renderer/services/— add the React Query service hook (nowindow.apiin UI).services/query-client.ts— add the query key.
Missing any step = an incomplete capability (HIGH). The contract in packages/shared is the single source of truth.
Capabilities & permissions
- New commands must be allowed in
capabilities/default.json— an exposed-but-unlisted command, or an over-broad capability, is a security finding (defer the security lens totauri-security-reviewer). - Principle of least privilege for filesystem/shell/network scopes.
Renderer ↔ shell
Renderer talks to the shell only via the AppClient context (createTauriInvokeClient() in apps/desktop/src/tauri-client/index.ts). No direct invoke in features/routes/components.
Boundaries
packages/shared— no React, no Node APIs.packages/ui— no Zustand, no IPC, no routing.packages/prompts— no UI, nowindow.
External standards & best-practices (verified 2026-06-19)
Latest stable Tauri 2.10.x. v2 model = permissions (per-command) + scopes (arg validators) + capabilities (bind sets to windows); no command is exposed by default. https://v2.tauri.app/security/
- Least-privilege capabilities — grant only what each window needs in
capabilities/*.json; scope to specificwindows/webviews; preferallow-scopes; never ship*-stylefs/shell/http. https://v2.tauri.app/security/capabilities/ - CSP — strict
app.security.cspintauri.conf.json; nounsafe-inline/unsafe-eval(Tauri hashes/nonces local assets). https://v2.tauri.app/security/csp/ - IPC surface — treat every
#[tauri::command]as an untrusted entry point; validate/sanitize args in Rust; keep the command set minimal; gate sensitive commands behind their own narrow capability. - Isolation pattern —
app.security.pattern = "isolation"to verify IPC in a sandboxed iframe whenever the frontend renders any remote/untrusted content. https://v2.tauri.app/concept/inter-process-communication/isolation/ - Updater signing (mandatory) — minisign-sign every release; ship the public key in
plugins.updater.pubkey; private key + password offline (CI secret only); HTTPS manifests. https://v2.tauri.app/plugin/updater/ - Dep hygiene —
cargo auditclean (e.g. RUSTSEC-2026-0098rustls-webpkican reach the updater/HTTP TLS stack); minimize plugins; track https://github.com/tauri-apps/tauri/security/advisories
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 45 lines · 47 tokens per session scan A a86cc6a17ab9
tauri-standards is a skill published in the GitHub repository saeedkolivand/ai-job-hunter-app (55 stars, last pushed yesterday), licensed Apache-2.0. It adds 47 tokens to every session and 865 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
python-patterns
Python development principles and decision-making. Framework selection, async patterns, type hints, project structure. Teaches thinking, not copying.
rust-pro
Master Rust 1.75+ with modern async patterns, advanced type system features, and production-ready systems programming. Expert in Tokio, Axum, and zero-cost abstractions.
client-setup
Create a vanilla tRPC client with createTRPCClient (), configure link chain with httpBatchLink/httpLink, dynamic headers for auth, transformer on links (not client constructor). Infer types with inferRouterInputs and inferRouterOutputs. AbortController signal support. TRPCClientError typing.
adapter-express
Mount tRPC as Express middleware with createExpressMiddleware() from @trpc/server/adapters/express. Access Express req/res in createContext via CreateExpressContextOptions. Mount at a path prefix like app.use('/trpc', ...). Avoid global express.json() conflicting with tRPC body parsing for FormData.
trpc-router
Entry point for all tRPC skills. Decision tree routing by task: initTRPC.create(), t.router(), t.procedure, createTRPCClient, adapters, subscriptions, React Query, Next.js, links, middleware, validators, error handling, caching, FormData.
azure-eventhub-rust
Azure Event Hubs library for Rust. Send and receive events for streaming data ingestion and batch processing. Triggers: "event hubs rust", "ProducerClient rust", "ConsumerClient rust", "send event rust", "streaming rust", "eventhub rust".