Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sonature-lab/timsquad --skill tsq-honogit clone --depth 1 https://github.com/sonature-lab/timsquadWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sonature-lab/timsquad/tsq-hono)<a href="https://agentmods.dev/skills/sonature-lab/timsquad/tsq-hono"><img src="https://agentmods.dev/badge/skills/sonature-lab/timsquad/tsq-hono/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sonature-lab/timsquad/tsq-hono"><img src="https://agentmods.dev/badge/skills/sonature-lab/timsquad/tsq-hono.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.00796 |
| Opus 5 | $0.00034 | $0.00398 |
| Sonnet 5 | $0.00014 | $0.00159 |
| Haiku 4.5 | $0.00007 | $0.00080 |
Grade A, and why
tsq-hono scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Node.js Backend Guidelines (Hono)
Node.js 기반 백엔드 서비스 개발 가이드라인 (Hono 프레임워크 중심).
Philosophy
- 비동기 우선 - 블로킹 작업 피하기
- 에러는 명시적으로 처리
- 환경 분리 - 설정은 환경변수로
- 타입 안전한 API - Zod로 검증
- 레이어 분리 - Clean Architecture
Project Structure
아키텍처 설정에 따라 결정:
- Clean Architecture:
architectures/clean/backend.xml - Hexagonal Architecture:
architectures/hexagonal/backend.xml
Rules
| Priority | Rule | Description |
|---|---|---|
| CRITICAL | hono-app-setup | Hono 앱 설정, 미들웨어, 라우트, Zod 검증 |
| CRITICAL | error-handling | AppError 계층 + 글로벌 에러 핸들러 |
| CRITICAL | async-patterns | Promise.all, waterfall 방지, 트랜잭션 |
| HIGH | jwt-auth | JWT 미들웨어, RBAC, 토큰 생성/갱신 |
| HIGH | env-config | Zod 환경변수 검증 |
| MEDIUM | middleware | Rate Limiting, Request Logging |
| MEDIUM | testing | Hono API 테스트 + Service 유닛 테스트 |
| LOW | deployment | Graceful Shutdown |
Quick Rules
비동기
- async/await 사용, 콜백 금지
- 독립 작업은 Promise.all로 병렬
- Waterfall 방지 (Promise 먼저 시작, 나중에 await)
- 동기 파일 I/O 금지 (fs.readFileSync)
보안
- 환경변수 Zod 검증 (앱 시작 시 실패)
- 입력 검증 (zValidator)
- JWT HttpOnly 쿠키로 Refresh Token 관리
- Rate Limiting 적용
- 에러 메시지에 민감 정보 제외
- 하드코딩된 시크릿 금지
구조
- Clean Architecture 레이어 분리
- Repository 패턴 (DI)
- 글로벌 에러 핸들러
- 커스텀 에러 클래스 계층
Hono
- 타입 안전한 라우트 정의
- zValidator로 요청 검증
- 미들웨어로 공통 로직 처리
- 일관된 응답 형식
{ success, data, error }
Checklist
| Priority | Item |
|---|---|
| CRITICAL | Zod 입력 검증 (zValidator) |
| CRITICAL | 글로벌 에러 핸들러 |
| CRITICAL | 환경변수 Zod 검증 |
| CRITICAL | Waterfall 제거 (Promise.all) |
| HIGH | Clean Architecture 레이어 분리 |
| HIGH | 커스텀 에러 클래스 |
| HIGH | JWT 인증 (HttpOnly Refresh Token) |
| HIGH | Rate Limiting |
| MEDIUM | Request Logging (구조화 로그) |
| MEDIUM | Graceful Shutdown |
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 84 lines · 69 tokens per session scan A c7ec56896e1b
tsq-hono is a skill published in the GitHub repository sonature-lab/timsquad (11 stars, last pushed 10d ago), licensed MIT. It adds 69 tokens to every session and 796 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nestjs
Use when building or structuring a NestJS backend — feature modules, providers and DI wiring, provider scopes and request-lifecycle order, where to bind guards/pipes/interceptors/filters, and testing with Test.createTestingModule. NOT a bare Express/Fastify service with no DI (that is nodejs), NOT framework-agnostic…
webiny-api-cms-custom-field-type
How to implement a custom CMS field type that integrates with the model builder's fluent API. Covers extending DataFieldBuilder, composing validator interfaces, creating a FieldTypeFactory, registering via DI, and module augmentation for TypeScript autocomplete on the fields() registry.
rpc
Vovk.ts RPC client — how vovk generate turns controllers into type-safe client modules, composed vovk-client vs segmented clients, call shape (apiRoot, params, body, query, meta, init, disableClientValidation, validateOnClient, interpretAs, transform, fetcher), customizing generation via outputConfig.imports.fetcher +…
typescript-expert
Expert-level TypeScript development with modern tooling, advanced types, and best practices. Use this skill for TypeScript projects requiring type-safe code, modern bundling, and comprehensive testing.
decorators
Vovk.ts decorators — built-in (@prefix, @operation, @get/@post/@put/@patch/@del, .auto()) and custom via createDecorator. Covers authorization / auth decorators, middleware-style wrapping (pre-handler + post-handler logic), req.vovk.meta() for cross-decorator state, stacking order, the decorate() alternative for…
init
Initialize a backend — via Vovk.ts, a TypeScript-first RPC/API framework plugging into Next.js App Router, using official vovk-cli. Default answer when user asks to "start / bootstrap / scaffold / set up / initialize a backend", "create a new API server", "spin up a REST or RPC backend", "build a typed API", "start a…