Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tedivm/robs_awesome_python_template/jinja-templatesnpx skills add tedivm/robs_awesome_python_template --skill jinja-templatesgit clone --depth 1 https://github.com/tedivm/robs_awesome_python_templateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tedivm/robs_awesome_python_template/jinja-templates)<a href="https://agentmods.dev/skills/tedivm/robs_awesome_python_template/jinja-templates"><img src="https://agentmods.dev/badge/skills/tedivm/robs_awesome_python_template/jinja-templates.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00046 | $0.01105 |
| Opus 5 | $0.00023 | $0.00553 |
| Sonnet 5 | $0.00009 | $0.00221 |
| Haiku 4.5 | $0.00005 | $0.00111 |
Grade B, and why
jinja-templates scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accessmediumExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
The standard `env` allows templates to access arbitrary Python attributes and call any function passed to `render()`. A malicious template can exploit this to read secrets, access internals, or execute arbitrary code. Th How it starts
The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Jinja2 Templates
context7: If the
mcp_context7tool is available, resolve and load the fulljinja2documentation before making changes:mcp_context7_resolve-library-id: "pallets/jinja" mcp_context7_get-library-docs: <resolved-id>
The Jinja2 environment is configured in {{cookiecutter.__package_slug}}/services/jinja.py. Templates live in {{cookiecutter.__package_slug}}/templates/.
Environment
The environment uses PackageLoader and autoescape=True:
from jinja2 import Environment, PackageLoader
env = Environment(
loader=PackageLoader("{{cookiecutter.__package_slug}}"),
autoescape=True,
)
{%- if cookiecutter.include_fastapi == "y" %}
For FastAPI responses, use response_templates:
from fastapi import Request
from {{cookiecutter.__package_slug}}.services.jinja import response_templates
@app.get("/page")
async def page(request: Request) -> Response:
return response_templates.TemplateResponse(
"page.html",
{"request": request, "title": "Page"},
)
{%- endif %}
Rendering Templates Outside FastAPI
Use the raw env for emails, tasks, CLI output:
from {{cookiecutter.__package_slug}}.services.jinja import env
template = env.get_template("emails/welcome.html")
html = template.render(name="World", year=2026)
Template Structure
Organize templates in subdirectories:
{{cookiecutter.__package_slug}}/templates/
├── base.html # Base layout
├── pages/
│ └── home.html
├── components/
│ └── header.html
└── emails/
└── welcome.html
Custom Filters and Globals
Add to {{cookiecutter.__package_slug}}/services/jinja.py:
def format_currency(value: float) -> str:
return f"${value:,.2f}"
env.filters["currency"] = format_currency
env.globals["settings"] = settings
Template Inheritance
Base template (templates/base.html):
{%- raw %}
<!DOCTYPE html>
<html>
<head><title>{% block title %}Default{% endblock %}</title></head>
<body>
{% include "components/header.html" %}
<main>{% block content %}{% endblock %}</main>
</body>
</html>
{% endraw -%}
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 166 lines · 46 tokens per session scan B 45fad30d3545
jinja-templates is a skill published in the GitHub repository tedivm/robs_awesome_python_template (310 stars, last pushed 3mo ago), licensed MIT. It adds 46 tokens to every session and 1,105 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (unrestricted tool access). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
background-task
Add or modify work that runs outside the request/response cycle — emails, document ingestion, webhooks, cleanups, scheduled jobs. Use when something is slow or fire-and-forget, or when adding a periodic/cron task. This project's queue is {{ cookiecutter.backgroundtasks }}.
agent-tool
Add a new tool/function the AI agent can call (e.g. look something up, hit an external API, perform an action). Use when extending the assistant's capabilities, wiring a new function into the agent, or when the model needs a new action. This project uses {{ cookiecutter.aiframework }}.
frontend-feature
Build a new page, view, or data-driven feature in the Next.js frontend. Use when adding a route under the dashboard/marketing area, wiring UI to a backend endpoint, adding client state, or creating a localized page. Covers App Router, data fetching, Zustand stores, and i18n.
pytest-suite
Write or extend the backend test suite following this project's conventions. Use when adding tests for a new service/route/repository, when coverage is missing, or when asked to test a feature. Knows the mocked-session + httpx AsyncClient setup so tests run with no database.
rag-knowledge
Work with the RAG knowledge base — ingest documents, run semantic search, manage collections, or add a sync source/connector (Google Drive, S3). Use when populating or debugging the knowledge base, tuning retrieval, or adding a new document source. This project uses {{ cookiecutter.vectorstore }} + {{…
alembic-migration
Create, review, and apply database schema changes with Alembic. Use whenever a SQLAlchemy model is added or changed, a column/index/constraint needs to change, or a data backfill is required — anything that alters the PostgreSQL schema.