Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TNT-Likely/honeycomb --skill scaffoldgit clone --depth 1 https://github.com/TNT-Likely/honeycombWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tnt-likely/honeycomb/scaffold)<a href="https://agentmods.dev/skills/tnt-likely/honeycomb/scaffold"><img src="https://agentmods.dev/badge/skills/tnt-likely/honeycomb/scaffold/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tnt-likely/honeycomb/scaffold"><img src="https://agentmods.dev/badge/skills/tnt-likely/honeycomb/scaffold.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00170 | $0.04096 |
| Opus 5.5 | $0.00068 | $0.01638 |
| Sonnet 5.5 | $0.00034 | $0.00819 |
| Haiku 4.5 | $0.00017 | $0.00410 |
Grade A, and why
scaffold-fastapi-vite-saas scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 225 lines — stays where its author put it; the contents beside it link to each section on GitHub.
FastAPI + Vite SaaS 脚手架技能
这套架构是什么
一个单仓双端的全栈应用骨架:Python 后端 + 前端 SPA 共住一个 git 仓库,通过多阶段 Docker 构建打成单一镜像,GitHub Actions 自动发版。核心定位:用一个 docker run 就能跑起来的自托管 SaaS。
技术选型(每一项都解释为什么):
| 层 | 选型 | 为什么 |
|---|---|---|
| Web framework | FastAPI | Pydantic v2 校验直接当 schema、async 原生、OpenAPI 自动生成 |
| ORM | SQLAlchemy 2.x | 久经考验、async 支持成熟、Alembic 配套迁移成熟 |
| Migrations | Alembic | 不要自己搞 schema_migrations 表 |
| Auth | JWT(PyJWT)+ passlib + 可选 pyotp 2FA | 无状态、单镜像无 redis 依赖 |
| 调度 | APScheduler BackgroundScheduler | in-process,不引入额外服务;线程池避免阻塞事件循环 |
| 备份加密 | pyzipper(AES-256 zip) | stdlib zipfile 的 ZipCrypto 已破,pyzipper 是 drop-in 替换 |
| 对象存储 | rclone subprocess | 一个二进制覆盖 S3/R2/WebDAV/B2/GDrive/OneDrive |
| Lint/Type/Test | ruff + mypy + pytest | 标配,启动快 |
| Frontend | pnpm workspace + Vite + (React/Vue 任选) | apps/* + packages/* 拆分清晰 |
| 构建产物 | 单一 Docker 镜像 | 多阶段:Node build 前端 → Python 运行时拷 dist/ 当静态 |
| CI | GitHub Actions | ci.yml(test/lint/build)+ release.yml(tag 触发 → docker hub) |
| 编排 | Makefile | 不引入 just/task,Makefile 一份所有人都会读 |
仓库布局(基线)
<project>/
├── .github/
│ └── workflows/
│ ├── ci.yml # PR/push: ruff + mypy + pytest + frontend build
│ └── release.yml # tag 'v*': build & push docker image
├── .docs/ # 内部设计文档(不发布)
├── docs/ # 用户向文档(随发版打入镜像/网站)
├── alembic/
│ ├── env.py
│ ├── script.py.mako
│ └── versions/
├── data/ # 运行时数据(gitignored,.gitkeep 占位)
│ └── .gitkeep
├── frontend/
│ ├── pnpm-workspace.yaml
│ ├── package.json # 仅 workspace 根
│ ├── apps/
│ │ └── web/ # Vite SPA
│ └── packages/
│ ├── api-client/ # 类型化 API client(从 OpenAPI 生成)
│ ├── ui/ # 共享组件
│ └── features/ # 跨页可复用业务组件
├── scripts/ # 运维脚本(seed/backup/grant-admin/...)
├── src/ # Python package(直接 import,不再嵌一层)
│ ├── __init__.py
│ ├── main.py # FastAPI app + lifespan
│ ├── config.py # pydantic-settings,所有 env 集中定义
│ ├── database.py # engine / session / Base
│ ├── deps.py # FastAPI Depends 工厂(get_db / get_user / ...)
│ ├── models.py # SQLAlchemy ORM(小项目放一起,大了再拆)
│ ├── schemas.py # Pydantic schemas(同上)
│ ├── security.py # 密码哈希 + JWT 签发/校验 + 可选 TOTP
│ ├── error_handling.py # 全局异常 → JSON 响应映射
│ ├── observability.py # structured logging + metrics
│ └── routers/
│ └── <group>/
│ ├── __init__.py # 聚合 APIRouter,main.py import 不变
│ ├── _shared.py # 共享 imports/helpers/router 实例;__all__ 显式
│ └── <entity>.py # 单一资源的 POST/PATCH/DELETE 或一组 GET
├── tests/ # pytest,与 src/ 对称
├── .env.example # 所有 env 的注释样本(.env 进 gitignore)
├── .gitignore
├── alembic.ini
├── docker-compose.yml # 生产 compose(用户拿去 deploy)
├── docker-compose.postgres.yml # overlay,可选切换 Postgres
├── Dockerfile # 多阶段:frontend-builder → python:3.12-slim
├── Makefile # 唯一的命令编排入口
├── mypy.ini
├── pytest.ini
├── README.md / README.en.md # 双语
├── requirements.txt # 不用 pyproject — 简单项目 requirements 更直白
├── ruff.toml
└── server.py # 极简 entry:from src.main import app
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 225 lines · 170 tokens per session scan A 279dc4ead8e7
scaffold-fastapi-vite-saas is a skill published in the GitHub repository TNT-Likely/honeycomb (2 stars, last pushed 15d ago), licensed MIT. It adds 170 tokens to every session and 4,096 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
design-code-architecture
Guided journey from an app idea to a deliberate architecture: boundaries, domain model, data decisions, and resilience, making only the expensive-to-reverse decisions and deferring the rest. Orchestrates eight skills phase by phase - clean-architecture, domain-driven-design, system-design, ddia-systems…
system-design
Design scalable distributed systems using structured approaches for load balancing, caching, database scaling, and message queues. Use when the user mentions "system design", "scale this", "high availability", "rate limiter", "design a URL shortener", "design Twitter", "design Uber", "design a news feed", "system…
dotnet-backend-expert
This skill should be used when the user is writing, reviewing, debugging, or architecting pure .NET backend code for Kestrel-hosted services. It provides expert critique for REST endpoints, SignalR hubs, TypeScript/React client integration shape, pragmatic Rust interop, application services, AppHost-aware project…
validate-api
Run the project's Hurl scenarios with an OIDC access token passed as a secret variable.
python-backend-expert
This skill should be used when the user is writing, reviewing, debugging, or architecting Python backend code using Litestar or FastAPI with SQLAlchemy or Advanced Alchemy. Provides expert critique covering SOLID principles, hexagonal architecture, repository/service patterns, dependency injection, async correctness…
backend-architecture
This skill should be used for consequential backend architecture decisions: module or service boundaries; modular monoliths versus independent services; service extraction and data migration; data ownership and consistency; synchronous, event-driven, actor/stateful, or pipeline designs; failure isolation…