Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/yerdaulet-damir/vibe-coding-rulesnpx agentmods add skills/yerdaulet-damir/vibe-coding-rules/add-providerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yerdaulet-damir/vibe-coding-rules/add-provider)<a href="https://agentmods.dev/skills/yerdaulet-damir/vibe-coding-rules/add-provider"><img src="https://agentmods.dev/badge/skills/yerdaulet-damir/vibe-coding-rules/add-provider/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yerdaulet-damir/vibe-coding-rules/add-provider"><img src="https://agentmods.dev/badge/skills/yerdaulet-damir/vibe-coding-rules/add-provider.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.01406 |
| Opus 5 | $0.00034 | $0.00703 |
| Sonnet 5 | $0.00014 | $0.00281 |
| Haiku 4.5 | $0.00007 | $0.00141 |
Grade A, and why
add-provider scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 188 lines — stays where its author put it; the contents beside it link to each section on GitHub.
add-provider
A provider added wrong leaks its API shape into your business logic. One API change from the vendor → rewrite half your service. Follow this checklist.
Step 1 — Decide: file or folder?
| Provider supports | Structure |
|---|---|
| One modality (text only, image only) | app/providers/<name>.py |
| Multiple modalities (image + video) | app/providers/<name>/ with image.py, video.py, __init__.py |
Principle A4: one file per format when a provider handles multiple formats.
Step 2 — Create the provider file from this template
# app/providers/<name>.py (or app/providers/<name>/image.py)
from __future__ import annotations
import logging
from decimal import Decimal
import httpx
from app.core.bulkhead import get_provider_client # Principle B5
from app.core.context import provider_ctx # Principle B7
from app.providers.base import AIProvider, JobRequest, JobResult
from app.providers.exceptions import (
ProviderError,
ProviderInvalidResponseError,
ProviderRateLimitError,
ProviderTimeoutError,
)
logger = logging.getLogger(__name__)
class <Name>Provider:
provider_name = "<name>" # used in logs + bulkhead key
async def generate(self, request: JobRequest) -> JobResult:
provider_ctx.set(self.provider_name) # Principle B7: set before any I/O
client = get_provider_client(self.provider_name) # Principle B5: isolated client
try:
response = await client.post(
"/v1/generate",
json=self._build_payload(request),
headers={"X-Idempotency-Key": request.idempotency_key}, # Principle B6
timeout=30.0,
)
response.raise_for_status()
except httpx.TimeoutException as e:
raise ProviderTimeoutError(
message=str(e), provider=self.provider_name, retryable=True
) from e
except httpx.HTTPStatusError as e:
self._map_http_error(e)
return self._parse_response(response.json(), request) # Principle B3: ACL here
def _build_payload(self, request: JobRequest) -> dict:
return {"prompt": request.prompt, "model": request.model_id, **request.params}
def _parse_response(self, data: dict, request: JobRequest) -> JobResult:
# ACL: validate and map to our domain type. Never return raw data.
try:
url = data["output"]["url"] # adjust to actual provider shape
cost = Decimal(str(data.get("cost", "0")))
except (KeyError, TypeError) as e:
raise ProviderInvalidResponseError(
message=f"Unexpected response shape: {e}",
provider=self.provider_name,
retryable=False,
raw_response=data,
) from e
return JobResult(
url=url,
cost_usd=cost,
provider=self.provider_name,
model_id=request.model_id,
)
def _map_http_error(self, e: httpx.HTTPStatusError) -> None:
if e.response.status_code == 429:
retry_after = int(e.response.headers.get("Retry-After", 60))
raise ProviderRateLimitError(
message="Rate limited",
provider=self.provider_name,
retryable=True,
retry_after=retry_after,
) from e
raise ProviderError(
message=f"HTTP {e.response.status_code}",
provider=self.provider_name,
retryable=e.response.status_code >= 500,
) from e
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 188 lines · 69 tokens per session scan A 8cb61cc56aea
add-provider is a skill published in the GitHub repository yerdaulet-damir/vibe-coding-rules (13 stars, last pushed 4mo ago), licensed MIT. It adds 69 tokens to every session and 1,406 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
llm-provider
Adds a new LLM provider implementing LLMProvider interface with call() and stream() methods. Integrates with provider factory in src/llm/index.ts, config detection in src/llm/config.ts, and error handling via tracking and recovery. Use when adding a new model backend, integrating a third-party LLM API, or extending…
gemini-webhooks
Receive and verify Google Gemini API webhooks. Use when setting up Gemini webhook handlers for batch jobs, video generation, or Interactions API function-calling LROs, debugging signature verification, or handling events like batch.succeeded, batch.failed, video.generated, or interaction.completed.
llm-pipeline
Use when wiring several LLM calls into a production flow: typed contracts between steps, a router/gateway so 429s, timeouts and outages fail over instead of taking you down, and cost control via caching, model tiers and abort caps. NOT single-prompt wording (that is prompt-engineering), NOT a model-driven tool loop…
design-serialization-schema
Design serialization schemas using JSON Schema, Protocol Buffer definitions, or Apache Avro. Covers schema versioning, backwards compatibility, validation rules, and evolution strategies for long-lived data formats. Use when defining a new API contract or data interchange format, adding fields to an existing schema…
implement-telegram-bot
Implement Telegram bot interactions with command handlers, message parsing, and inline keyboards for conversational interfaces.
integrate-graph-api
Integrate with Microsoft Graph API for email, calendar, and organizational data access with proper authentication and error handling.