Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add spinspire/pocketbase-sveltekit-starter --skill pwagit clone --depth 1 https://github.com/spinspire/pocketbase-sveltekit-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/spinspire/pocketbase-sveltekit-starter/pwa)<a href="https://agentmods.dev/skills/spinspire/pocketbase-sveltekit-starter/pwa"><img src="https://agentmods.dev/badge/skills/spinspire/pocketbase-sveltekit-starter/pwa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/spinspire/pocketbase-sveltekit-starter/pwa"><img src="https://agentmods.dev/badge/skills/spinspire/pocketbase-sveltekit-starter/pwa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.02000 |
| Opus 5 | $0.00036 | $0.01000 |
| Sonnet 5 | $0.00014 | $0.00400 |
| Haiku 4.5 | $0.00007 | $0.00200 |
Grade A, and why
pwa scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
event.respondWith(fetch(event.request)); How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PWA Installability
Make a web app installable and iOS-friendly with a minimal service worker. Default posture is network-only (no caching) unless the app needs offline — pick a strategy deliberately, never by default.
When to Use
- "Make it installable / a PWA"
- "Add a service worker" / "add a web manifest" / "add to home screen"
- "Works offline?" or "works on iPhone?"
The Three Pillars
- HTTPS — required for service workers (localhost exempt in dev).
- Web app manifest — name, icons, start_url, display → makes it installable.
- Service worker — background script; active SW + valid manifest unlocks the install prompt.
Quick Reference
| Asset | Where it goes | Notes |
|---|---|---|
manifest.webmanifest |
site root (static/ for SvelteKit) |
name, short_name, start_url, scope, display standalone, theme/background color, icons 192+512 + maskable |
favicon-32/48/64.png |
root | browser tab icons; also apple-touch-icon.png 180px for iOS |
icon-192.png, icon-512.png |
root | required by Chrome for install |
icon-maskable-512.png |
root | full-bleed background, content in center 80% safe zone |
sw.js |
root (static/ for SvelteKit) |
register from client code; served at site root for correct scope |
offline.html (optional) |
root | fallback for failed navigations if offline support is wanted |
Service Worker
Default: network-only (no caching)
self.addEventListener('install', () => {
self.skipWaiting();
});
self.addEventListener('activate', (event) => {
event.waitUntil(clients.claim());
});
self.addEventListener('fetch', (event) => {
event.respondWith(fetch(event.request));
});
This makes the app installable and always-fresh. Use for apps where data lives server-side / in a spreadsheet and serving stale data is wrong.
Offline fallback (add only if offline support is requested)
const CACHE = 'capstone-v1';
self.addEventListener('install', (event) => {
event.waitUntil(
caches.open(CACHE).then((c) => c.addAll(['/', '/offline.html', '/manifest.webmanifest', '/icon-192.png', '/icon-512.png']))
);
self.skipWaiting();
});
self.addEventListener('activate', (event) => {
event.waitUntil(
caches.keys().then((keys) => Promise.all(keys.filter((k) => k !== CACHE).map((k) => caches.delete(k)))).then(() => clients.claim())
);
});
self.addEventListener('fetch', (event) => {
const url = new URL(event.request.url);
if (event.request.mode === 'navigate') {
event.respondWith(fetch(event.request).catch(() => caches.match('/offline.html')));
return;
}
if (url.origin === location.origin && ['css', 'js', 'svg', 'png', 'jpg', 'woff2'].some((ext) => url.pathname.endsWith('.' + ext))) {
event.respondWith(caches.match(event.request).then((cached) => cached || fetch(event.request).then((res) => { const clone = res.clone(); caches.open(CACHE).then((c) => c.put(event.request, clone)); return res; })));
return;
}
event.respondWith(fetch(event.request));
});
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 180 lines · 72 tokens per session scan A d6622d50a49f
pwa is a skill published in the GitHub repository spinspire/pocketbase-sveltekit-starter (507 stars, last pushed 19d ago), licensed MIT. It adds 72 tokens to every session and 2,000 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mobile-web-app
Add router-agnostic, native app-like page transitions to mobile web apps with SSGOI. Explore live drill, sheet, slide, and zoom demos at https://ssgoi.dev. Use when building or improving a mobile web app's routed page structure, layouts, or transitions, or when a project uses SSGOI or an @ssgoi package.
shadcn-sveltekit-design
Use when building, redesigning, beautifying, or refactoring SvelteKit pages and reusable components with shadcn-svelte, Bits UI, or the shadcn-svelte MCP. Trigger on landing pages, dashboards, marketing sites, app shells, forms, navbars, tables, dialogs, responsive layouts, theming, icon selection, and requests to…
svelte-expert
Expert knowledge in Svelte framework, SvelteKit, reactivity system, compiled approach, and building performant web applications. Use when the user mentions SvelteKit, reactivity, compiler, frontend, performance, or JavaScript, or when the task involves Svelte Fundamentals, Reactivity System, Installation and Setup, or…
sveltekit
SvelteKit - Full-stack Svelte framework with file-based routing, SSR/SSG, form actions, and adapters for deployment.
svelte
Svelte 5 - Reactive UI framework with compiler magic, Runes API, SvelteKit full-stack framework, SSR/SSG, minimal JavaScript.
svelte5-runes-static
Svelte 5 runes + SvelteKit adapter-static (SSG/SSR) patterns for hydration-safe state, store bridges, and reactivity that survives prerendering.