Borrowing it
Nothing to install: this file belongs to zenml-io/kitaru. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zenml-io/kitaru/develop/.agents/skills/kitaru-ui-api-development/SKILL.mdgit clone --depth 1 https://github.com/zenml-io/kitaruWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zenml-io/kitaru/kitaru-ui-api-development)<a href="https://agentmods.dev/skills/zenml-io/kitaru/kitaru-ui-api-development"><img src="https://agentmods.dev/badge/skills/zenml-io/kitaru/kitaru-ui-api-development.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.01350 |
| Opus 5 | $0.00032 | $0.00675 |
| Sonnet 5 | $0.00013 | $0.00270 |
| Haiku 4.5 | $0.00006 | $0.00135 |
Grade A, and why
kitaru-ui-api-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kitaru UI API Development
Use this for changes that cross the Kitaru server API and the Kitaru UI in zenml-frontend-monorepo. Load the same-name kitaru-dev repo skill for the current host for general commands and PR guidance. Use FRONTEND-TESTING.md and the current host's kitaru-release repo skill only when the change also affects UI bundling, serving, selection, or publication.
These rules reflect the current UI endpoints, their frontend consumers, and frontend maintainer guidance.
Decide whether the route belongs under /api/v1/ui
Search the live routers, OpenAPI contract, and frontend modules for an existing route and consumer before designing another one. If they already satisfy the requested screen, verify that flow and do not add a duplicate endpoint.
Use a UI-specific endpoint when a frontend screen needs a response shape that the existing resource APIs do not provide. For example, /api/v1/sessions returns sessions without their evaluations, while /api/v1/ui/sessions returns sessions together with their evaluations for the sessions table. Another current endpoint aggregates evaluations across an experiment run for a frontend view.
Prefer the normal /api/v1/<resource> API when the behavior is a reusable domain operation or an external SDK consumer would reasonably need it. Do not add a UI endpoint merely to move ordinary presentation logic to the server.
Before implementation, state:
- the concrete frontend consumer and the data shape it needs
- why the contract is UI-specific rather than a reusable resource API
- whether the response is a pageable collection, a singular resource, or a bounded aggregate, with its ordering, pagination, caps, missing-data, and empty-state semantics
- whether the response can be assembled through current application services
There is no established precedent for frontend-only mutations. If the request adds one, stop and ask the maintainers to agree on its placement. New domain behavior and generally useful external APIs should go through the normal resource checklist instead.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed c6de62622c96
- 6d ago First seen · 74 lines · 63 tokens per session scan A d47ab357fcf5
kitaru-ui-api-development is a skill published in the GitHub repository zenml-io/kitaru (280 stars, last pushed yesterday), licensed Apache-2.0. It adds 63 tokens to every session and 1,350 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
copilotkit-upgrade
Use when migrating a CopilotKit v1 application to v2 -- updating package imports, replacing deprecated hooks and components, switching from GraphQL runtime to AG-UI protocol runtime, and resolving breaking API changes.
langbot-dev
Develop, build, and debug the LangBot core backend and web frontend. Use when working inside the LangBot repository — backend (Python/Quart, src/langbot/pkg), the Vite/React web UI, HTTP API controllers/services, Alembic migrations, or the MCP server. Covers the dev environment (uv, pnpm), repo layout, the API auth…
stripe-apps
Use when building, modifying, or reviewing a Stripe App — or when the user describes something that implies one (e.g. "add a panel to the customer page", "customize my Stripe Dashboard", "react to Stripe events from my app", "connect my service to Stripe without sharing API keys"). Covers the full app development…
testing
Verify a Skyvern deployment is working correctly by smoke-testing the backend API, frontend rendering, browser session provisioning, and workflow execution. Use when the user says 'is Skyvern working', 'test my deployment', 'verify the installation', 'smoke test', or needs to check that a self-hosted or local Skyvern…
vercel-composition-patterns
React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.
healthchain
Use when building, debugging, or deploying a Python service that touches FHIR resources, EHR APIs, CDS Hooks, clinical documents, or patient data — including writing model or agent output back into a patient record, connecting to Epic/Cerner/Medplum, or serving FHIR tools to an agent over MCP or LangChain.