Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add greendesertsnow/pocketbase-skills --skill pocketbase-best-practicesgit clone --depth 1 https://github.com/greendesertsnow/pocketbase-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/greendesertsnow/pocketbase-skills/pocketbase-best-practices)<a href="https://agentmods.dev/skills/greendesertsnow/pocketbase-skills/pocketbase-best-practices"><img src="https://agentmods.dev/badge/skills/greendesertsnow/pocketbase-skills/pocketbase-best-practices/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/greendesertsnow/pocketbase-skills/pocketbase-best-practices"><img src="https://agentmods.dev/badge/skills/greendesertsnow/pocketbase-skills/pocketbase-best-practices.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.02669 |
| Opus 5 | $0.00044 | $0.01334 |
| Sonnet 5 | $0.00017 | $0.00534 |
| Haiku 4.5 | $0.00009 | $0.00267 |
Grade A, and why
pocketbase-best-practices scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PocketBase Best Practices
PocketBase is a single-binary backend (SQLite + REST + realtime + auth) that is easy to start with and easy to misuse at scale. This skill gives AI agents the guardrails: 64 rules across 9 categories, each with an incorrect vs. correct code example, covering the mistakes agents actually make — insecure API rules, unindexed queries, broken auth flows, N+1 expands, leaked server-side handles.
Updated for PocketBase v0.40 and JS SDK v0.28 (August 2026). Works with v0.36+.
How rules are prioritized
Every rule carries an impact level: Critical = security holes or broken data models, High = performance and correctness problems, Medium/Low = operational polish. When rules conflict, higher impact wins.
What's covered
| Category | Impact | What it protects you from |
|---|---|---|
| Collection Design | Critical | Wrong field types, missing indexes, manual ID strings instead of relations |
| API Rules & Security | Critical | Data leaks from empty/incorrect access rules, filter injection |
| Authentication | Critical | Broken password/OAuth2/OTP/MFA flows, token mishandling |
| SDK Usage | High | Bad client setup, swallowed errors, cancelled-request bugs |
| Query Performance | High | N+1 queries, over-fetching, missing pagination |
| Realtime | Medium | Dropped subscriptions, unauthenticated realtime access |
| File Handling | Medium | Unvalidated uploads, wrong file URLs, missing thumbnails |
| Production & Deployment | Medium | No backups, no rate limits, exposed superuser access |
| Server-Side Extending | High | Go/JSVM hook mistakes, transaction misuse, unsafe filter binding |
Quick Reference
Collection Design (CRITICAL)
- coll-field-types: Use appropriate field types (json for objects, select for enums)
- coll-auth-vs-base: Extend auth collection for users, base for non-auth data
- coll-relations: Use relation fields, not manual ID strings
- coll-indexes: Create indexes on frequently filtered/sorted fields
- coll-view-collections: Use views for complex aggregations
- coll-geopoint: Store coordinates as json field with lat/lng
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- AGENTS.md 6.4 KB
- metadata.json 1.5 KB
- references/api-rules-security.md 17 KB
- references/authentication.md 21 KB
- references/collection-design.md 15 KB
- references/file-handling.md 15 KB
- references/production-deployment.md 31 KB
- references/query-performance.md 28 KB
- references/realtime.md 19 KB
- references/sdk-usage.md 28 KB
- references/server-side-extending.md 75 KB
- rules/_sections.md 1.8 KB
- rules/_template.md 855 B
- rules/auth-impersonation.md 3.7 KB
- rules/auth-mfa.md 3.5 KB
- rules/auth-oauth2.md 4.9 KB
- rules/auth-otp.md 3.5 KB
- rules/auth-password.md 2.8 KB
- rules/auth-token-management.md 3.5 KB
- rules/coll-auth-vs-base.md 2.1 KB
- rules/coll-field-types.md 2.6 KB
- rules/coll-geopoint.md 3.3 KB
- rules/coll-indexes.md 2.3 KB
- rules/coll-relations.md 2.9 KB
- rules/coll-view-collections.md 2.1 KB
- rules/deploy-backup.md 4.2 KB
- rules/deploy-configuration.md 4.8 KB
- rules/deploy-rate-limiting.md 5.0 KB
- rules/deploy-reverse-proxy.md 5.6 KB
- rules/deploy-scaling.md 3.8 KB
- rules/deploy-sqlite-considerations.md 6.3 KB
- rules/deploy-superuser-ips.md 1.8 KB
- rules/ext-compose-request-flow.md 9.7 KB
- rules/ext-cron-jobs.md 4.4 KB
- rules/ext-filesystem.md 4.2 KB
- rules/ext-filter-binding-server.md 3.1 KB
- rules/ext-go-custom-sqlite.md 4.5 KB
- rules/ext-go-migrations.md 4.2 KB
- rules/ext-go-setup.md 3.6 KB
- rules/ext-hooks-chain.md 3.4 KB
- rules/ext-hooks-record-vs-request.md 3.0 KB
- rules/ext-js-migrations.md 4.7 KB
- rules/ext-js-setup.md 2.5 KB
- rules/ext-jsvm-modules.md 4.0 KB
- rules/ext-jsvm-scope.md 2.7 KB
- rules/ext-mailer.md 5.1 KB
- rules/ext-routing-custom.md 3.8 KB
- rules/ext-settings.md 4.3 KB
- rules/ext-testing.md 7.1 KB
- rules/ext-transactions.md 3.2 KB
- rules/file-serving.md 5.7 KB
- rules/file-upload.md 4.2 KB
- rules/file-validation.md 5.0 KB
- rules/query-back-relations.md 4.6 KB
- rules/query-batch-operations.md 4.9 KB
- rules/query-expand.md 3.9 KB
- rules/query-field-selection.md 3.5 KB
- rules/query-first-item.md 4.2 KB
- rules/query-n-plus-one.md 4.0 KB
- rules/query-pagination.md 3.3 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 163 lines · 87 tokens per session scan A 520c07d5aa0f
pocketbase-best-practices is a skill published in the GitHub repository greendesertsnow/pocketbase-skills (12 stars, last pushed 19d ago), licensed MIT. It adds 87 tokens to every session and 2,669 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pb-api
Operate PocketBase via its REST API. Use for CRUD operations on collections, authentication, querying records with filters, and managing PocketBase data.
system-design-data-architecture
Choose and scale the data layer: SQL versus NoSQL per access pattern, single data ownership, replication and read scaling, partition key choice, hot partition and celebrity key mitigation. Use when selecting a store, planning sharding, or fixing a data-tier bottleneck.
cosmosdb-best-practices
Azure Cosmos DB performance optimization and best practices guidelines for NoSQL, partitioning, queries, and SDK usage. Use when writing, reviewing, or refactoring code that interacts with Azure Cosmos DB, designing data models, optimizing queries, or implementing high-performance database operations. USE FOR: Cosmos…
api-design
A guide to designing application interfaces that other software can use, including REST, GraphQL, and gRPC APIs.
database
A guide to database structure, data migrations, queries, and indexes. A database stores application data; a migration changes its structure, and an index helps it find data faster.
domain-modeling
Use when introducing, reviewing, or renaming a top-level type, table, or domain concept; or choosing where state lives (in-memory vs persistent).