Neko Master is a dashboard that collects and visualizes network traffic from local gateway environments. It is for monitoring, auditing, and analyzing traffic across multiple gateways, with the catalogue entries providing instructions and skills for working with the dashboard.
Borrowing it
Nothing to install: this file belongs to foru17/neko-master. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/foru17/neko-master/main/.claude/skills/db-conventions/SKILL.mdgit clone --depth 1 https://github.com/foru17/neko-masterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/foru17/neko-master/db-conventions)<a href="https://agentmods.dev/skills/foru17/neko-master/db-conventions"><img src="https://agentmods.dev/badge/skills/foru17/neko-master/db-conventions.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00894 |
| Opus 5 | $0.00022 | $0.00447 |
| Sonnet 5 | $0.00009 | $0.00179 |
| Haiku 4.5 | $0.00004 | $0.00089 |
Grade A, and why
db-conventions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 39 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Data Layer Conventions (apps/collector)
Invariants (breaking any of these has bitten us before)
- One write path. All traffic stats go through
batchUpdateTrafficStats(database/repositories/traffic-writer.repository.ts); the whole flush is a single outer transaction (innerdb.transaction()calls degrade to savepoints). Never commit table groups independently — a mid-flush failure plus buffer retry double-counts. - Rule name = policy group. For multi-hop chains the aggregation key is the last chain hop (the user's policy group), produced only by
buildRuleName(shared/utils/rule-name.ts). Rule type + payload (RuleSet(foo)) is the key only for single-hop DIRECT/REJECT chains. The web flow graph and gateway-rule matching depend on this. - Delimiter-aware CSV dedup. Comma-list columns dedupe with
INSTR(',' || col || ',', ',' || @v || ',')— bareINSTRsubstring-matches (a.cominsideaa.com) and silently drops values. Lists are capped atLENGTH > 4000. - UTC time keys. Minute
YYYY-MM-DDTHH:MM:00, hourYYYY-MM-DDTHH:00:00, viatoMinuteKey/toHourKey(base.repository.ts). No local-time truncation. - backendId isolation everywhere. Every stats table, query, and cache key is scoped by
backend_id.PRAGMA foreign_keysis OFF — deleting a backend relies on the explicit table list indeleteBackendData; new tables must be added there. - Range routing. Range queries route by span in
resolveFactTable(base.repository.ts): ≤6h →minute_dim_stats, >6h →hourly_dim_stats. Retention must respect this: hourly dim tables followhourlyStatsDays, minute tables followconnectionLogsDays.
SQLite usage
- better-sqlite3, synchronous — long scans and big transactions block the event loop shared with WS ingest. Cap query result sets (
LIMIT), useMapmerges instead of nestedfindIndex, and prefer prepared statements cached on the instance for hot paths. - WAL mode with tuned pragmas is set in
modules/db/db.tsinit()(env-tunable:SQLITE_CACHE_MB,SQLITE_WAL_AUTOCHECKPOINT_PAGES,SQLITE_BUSY_TIMEOUT_MS). - Migrations are ad-hoc in
init()— idempotent (IF NOT EXISTS/ try-catch ALTER / app_config flags for one-time data migrations, seedatabase/rule-name-cleanup.tsas the reference pattern).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 39 lines · 43 tokens per session scan A fa4ac4e7ef45
db-conventions is a skill published in the GitHub repository foru17/neko-master (3,924 stars, last pushed 1mo ago), licensed MIT. It adds 43 tokens to every session and 894 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
data-viz-renderer
Generate self-contained HTML/SVG infographics from JSON data, including stat cards, bar charts, flow diagrams, and mixed dashboards. Offers 8 color palettes and built-in icons with no external dependencies. Triggered when users request data visualization, infographics, charts, or dashboards.
metabase-data-app-semantic-layer
Use when building, creating, or editing data apps that should query Metabase tables and metrics through generated schema files like metabase.data.ts or .metabase.data.ts.
building-incident-response-dashboard
Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident…
grafana-dashboard
Create, view, and manage Grafana dashboards with panels and datasources.
superset-dashboard
Create, view, and manage Superset dashboards with charts and datasets.
dashboard-designer
Use this skill when designing a data dashboard—choosing KPIs, structuring layout, applying visual hierarchy, or deciding which BI tool to use. Trigger phrases: 'design a dashboard', 'build a KPI dashboard', 'what should my dashboard show', 'help me layout a dashboard', 'dashboard for monitoring'. Not for building…