Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add viewflow/seedkit --skill django-seedkitgit clone --depth 1 https://github.com/viewflow/seedkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/viewflow/seedkit/django-seedkit)<a href="https://agentmods.dev/skills/viewflow/seedkit/django-seedkit"><img src="https://agentmods.dev/badge/skills/viewflow/seedkit/django-seedkit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/viewflow/seedkit/django-seedkit"><img src="https://agentmods.dev/badge/skills/viewflow/seedkit/django-seedkit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 49 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Data Exfiltration · line 61 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Tool Misuse · line 86 Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.Fix: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.
- medium Tool Misuse · line 87 Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.Fix: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00172 | $0.04660 |
| Opus 5.5 | $0.00069 | $0.01864 |
| Sonnet 5.5 | $0.00034 | $0.00932 |
| Haiku 4.5 | $0.00017 | $0.00466 |
Grade A, and why
django-seedkit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Start `uv run manage.py runserver --noreload` in the background. `--noreload` drops the StatReloader so the listener is ready sooner; a `sleep 2` then `curl` can still race on slow CI, so poll — and test the flag after How it starts
The opening of the file, as written. The whole thing — 200 lines — stays where its author put it; the contents beside it link to each section on GitHub.
How this skill works
Two paths:
- New project (empty dir, only
.git/or stub README): run §2 → §8 in order. - Existing project (has
pyproject.tomland Django code): skip §2–§4. Readreferences/existing-project.mdfor the inventory workflow, then jump to §5/§6 and ask only about missing components.
Before either path, run uv --version to confirm uv is installed (references/uv.md).
Every question below names the reference that answers it — read that one file before applying the step, and no others.
For every question that involves a third-party package: 1–2 sentences from the reference's intro on what it adds beyond stock Django, then ask. none (or no) is always a valid answer.
Use answers already given. Before asking any question, scan the user's initial request (and anything they've said since) for the answer. If it's there — explicit ("use PostgreSQL", "with Celery", "no auth") or unambiguous from context — take it as given, note the decision in one line, and move on. Don't re-ask to confirm. Only ask when the answer is genuinely missing or ambiguous.
Preflight — read these before the first tool call of a new-project run: references/new-project.md, references/database.md, and references/conventions.md (the cross-file contract: env var names, Redis DB map, prod compose service shape, SameSite rule, Python pins).
Instructions
1. Open the conversation
Name the groups you'll walk through — Project Foundation (§2), then Developer Experience, Auth & Accounts, Data & Storage, Background & Email, Frontend & Site Basics, SaaS / Product, Real-time (§5.1–5.7), then Production & Deploy (§6) — one sentence each. For existing projects: first follow references/existing-project.md and note what's already detected per group. Invite the user to begin.
2. Project Foundation — new projects only, one question at a time, in order
- Project name + one-line purpose (the explicit two-answer pair).
- Settings layout: single
settings.pyor splitbase/local/production. →references/new-project.md - Database: SQLite or PostgreSQL. →
references/database.md - Request handling:
wsgi/asgi/asgi+channels. Defaultwsgi. Decide now — DockerfileCMD, server choice, and themanage.py/wsgi.py/asgi.pysettings defaults all hinge on this; switching later means rewriting deploy artefacts. Seereferences/async.md(andreferences/realtime.mdfor the channels mode). - If Postgres: host Postgres or Postgres-in-Docker (
docker-compose.ymlfor the local services). SQLite users skip. →references/docker.md - If the project has a
docker-compose.yml(from step 5): dev loop —manage.pyon the host viauv run, or in awebcontainer viadocker compose. Default host. →references/docker.md - Custom user model: yes / no — decide now (see
references/custom-user.md).
What ships with it
47 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/analytics.md 6.3 KB
- references/async.md 4.4 KB
- references/auth-hardening.md 4.3 KB
- references/auth.md 7.9 KB
- references/billing.md 11 KB
- references/ci.md 3.9 KB
- references/conventions.md 2.5 KB
- references/cors.md 2.3 KB
- references/csp.md 3.6 KB
- references/custom-user.md 5.6 KB
- references/database.md 7.4 KB
- references/dbbackup.md 5.0 KB
- references/deploy-github-ssh.md 6.4 KB
- references/deploy-managed.md 2.9 KB
- references/deploy-vps.md 7.0 KB
- references/dev-tasks.md 6.5 KB
- references/dev-tools.md 14 KB
- references/devcontainer.md 2.1 KB
- references/docker.md 15 KB
- references/email.md 3.9 KB
- references/error-reporting.md 3.7 KB
- references/existing-project.md 4.7 KB
- references/favicon.md 2.7 KB
- references/gdpr.md 3.9 KB
- references/healthcheck.md 2.3 KB
- references/i18n.md 4.1 KB
- references/lint.md 2.2 KB
- references/logging.md 3.9 KB
- references/new-project.md 7.2 KB
- references/pre-commit.md 3.0 KB
- references/pytest.md 2.6 KB
- references/realtime.md 8.6 KB
- references/redis.md 2.6 KB
- references/rest-bolt.md 7.4 KB
- references/rest-modern-rest.md 3.4 KB
- references/rest.md 2.7 KB
- references/robots.md 1.8 KB
- references/security.md 2.0 KB
- references/seo.md 3.1 KB
- references/storage-s3.md 7.7 KB
- references/storage-whitenoise.md 2.8 KB
- references/tailwind.md 12 KB
- references/tasks-celery.md 5.3 KB
- references/tasks-django-cron.md 1012 B
- references/tasks-django.md 1.2 KB
- references/typecheck.md 4.3 KB
- references/uv.md 670 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed c18afd60b0a7
- 1mo ago First seen · 200 lines · 172 tokens per session scan A 53a7b2c1d41c
django-seedkit is a skill published in the GitHub repository viewflow/seedkit (66 stars, last pushed 8d ago), licensed MIT. It adds 172 tokens to every session and 4,660 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
django
Use when building, reviewing, securing, testing or shipping a Django app — models, migrations, QuerySets/managers, FBV/CBV views, forms, the admin, settings split, and Django REST Framework (serializers, ModelViewSet, permissions). NOT async FastAPI/Pydantic services (that is fastapi), NOT Postgres schema/index work…
cloudflare-workers-multi-lang
Multi-language Workers development with Rust, Python, and WebAssembly. Use when building Workers in languages other than JavaScript/TypeScript, or when integrating WASM modules for performance-critical code.
django-expert
Expert-level Django development for robust Python web applications with ORM, admin, and authentication. Use when the user mentions Python, web, ORM, MVC, or Django REST Framework, or when the task involves Django Architecture.
python-django-architecture
Use this skill when the user says 'Django structure', 'Django architecture', 'Django apps', 'Django clean arch', 'Django ORM', 'Django REST framework', 'DRF', or when building a Django application. This skill enforces: one Django app per bounded context, service layer pattern separating business logic from models…
django-celery-expert
Expert Django Celery guidance for asynchronous task processing. Use when designing background tasks, configuring Celery workers, handling task retries and errors, optimizing Celery performance, implementing periodic tasks with Celery Beat, or setting up production monitoring for Celery. Do not use for general Django…
django-expert
Expert Django backend development guidance. Use when creating Django models, views, serializers, or APIs; debugging ORM queries or migrations; optimizing database performance; implementing authentication; writing tests; or working with Django REST Framework. Follows Django best practices and modern patterns.