Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sergeyzwezdin/huba/react-developernpx skills add sergeyzwezdin/huba --skill react-developergit clone --depth 1 https://github.com/sergeyzwezdin/hubaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00203 | $0.00868 |
| Opus 5 | $0.00102 | $0.00434 |
| Sonnet 5 | $0.00041 | $0.00174 |
| Haiku 4.5 | $0.00020 | $0.00087 |
Grade A, and why
react-developer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
React Developer
Follow React best practices and Feature-Sliced Design architecture for clean, maintainable code.
Core Principles
- Components: Arrow functions, named exports,
{ComponentName}Propstype - Hooks: Extract at 3+ uses or complex stateful logic; return objects not arrays
- State: Local (
useState), Shared (Jotai atom), Server (TanStack Query) - FSD Layers:
app → pages → widgets → features → entities → shared(strict downward imports) - Performance: Profile before optimizing; composition over memo
Reference Files
Read only what's needed for the current task:
FSD Architecture
| File | Read when… |
|---|---|
| fsd-layers.md | Deciding which layer a component/hook belongs to; understanding import rules; layer purposes with examples |
| fsd-slices.md | Creating a new slice; organizing ui//model//lib/ segments; writing index.ts; path aliases; naming conventions |
| fsd-patterns.md | Composing features with entities; widget orchestration; cross-slice dependencies; anti-patterns; migration |
React & OpenTUI
| File | Read when… |
|---|---|
| react-components.md | Writing components, custom hooks, or managing state; component structure and organization rules |
| react-performance.md | Optimizing renders; deciding when to use React.memo; error handling patterns |
| opentui-patterns.md | Working with TUI elements (<box>, <text>); keyboard/renderer hooks; style prop patterns |
Common Workflows
Creating a New Component
- Identify correct FSD layer (page/widget/feature/entity) → fsd-layers.md
- Create slice directory if needed:
feature-name/ - Add to segment:
ui/component-name.tsx→ react-components.md - Export from public API:
index.ts→ fsd-slices.md
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 68 lines · 203 tokens per session scan A aacf4ccae9ec
react-developer is a skill published in the GitHub repository sergeyzwezdin/huba (10 stars, last pushed 5mo ago), licensed MIT. It adds 203 tokens to every session and 868 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
compliance-frameworks
Swiss financial regulatory compliance — FINMA, GwG/AML/KYC, FIDLEG/FINIG licensing, BankG, crypto/DLT regulation, cross-border obligations (AEOI/CRS, FATCA). Trigger when: user asks about FINMA licensing, AML/KYC compliance, financial services cross-border, crypto regulation, or fintech data processing. Do NOT trigger…
adversarial-analysis
Adversarial stress test — three agents (Advocate FOR, Adversary AGAINST, Judicial synthesis with probability). Trigger when: user wants to stress-test a position, check weaknesses before filing, or requests adversarial review. Also option '4' in /legal menu. Do NOT trigger for: initial research (swiss-legal-research)…
data-protection-law
Swiss data protection — nDSG/FADP framework, GDPR adequacy, cantonal DP laws (IDG/KDSG/LIPAD), DSFA/DPIA, cross-border transfers. Trigger when: user asks about nDSG/GDPR compliance, DPAs, data transfers, DPIA, data subject rights, or references FDPIC/nDSG/FADP. Do NOT trigger for: fintech regulatory compliance (use…
citation-content-verify
Substantive citation verifier — checks every citation in a draft against the live source for existence AND content support (entailment), before delivery. Status per citation: MATCH / PARTIAL / MISMATCH / UNVERIFIED. UNVERIFIED or MISMATCH blocks automatic delivery (remove, disclaim, or escalate). Trigger after any…
legal-5step-framework
End-to-end 5-step Swiss legal pipeline: (1) intake/fact extraction, (2) BGE/statute research, (3) strategy/risk assessment, (4) adversarial stress test, (5) verified document drafting. Trigger when: user asks for full analysis, 'run all steps', 'full pipeline', or 'end-to-end'. Do NOT trigger for: single-step tasks…
debug-workflow
Systematically debug failing n8n workflows — expression errors, node type mismatches, pinned data issues, sub-workflow failures, authentication problems, rate limit errors, and silent data loss. Use this skill whenever the user reports an n8n workflow problem — phrases like "my n8n workflow is failing", "this…