Grida is an open-source graphics workspace that combines an infinite canvas editor, SVG tools, a database and CMS, and forms. Designers and developers use it to create, import, render, and manage visual documents and connected data, while the catalogue add-ons support its workflows.
Borrowing it
Nothing to install: this file belongs to gridaco/grida. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/gridaco/grida/main/.agents/skills/database/SKILL.mdgit clone --depth 1 https://github.com/gridaco/gridaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gridaco/grida/database)<a href="https://agentmods.dev/skills/gridaco/grida/database"><img src="https://agentmods.dev/badge/skills/gridaco/grida/database/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gridaco/grida/database"><img src="https://agentmods.dev/badge/skills/gridaco/grida/database.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Prompt Injection · line 45 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00106 | $0.02802 |
| Opus 5.5 | $0.00042 | $0.01121 |
| Sonnet 5.5 | $0.00021 | $0.00560 |
| Haiku 4.5 | $0.00011 | $0.00280 |
Grade A, and why
database scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 258 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Database — operating contracts
Three contracts this skill protects:
- Applied migrations are immutable.
- The RLS spec is the source of truth — implementations follow tests, not the reverse.
schemas/*.sqlis the human-friendly description of the final shape.
supabase/AGENTS.md is the harder rule layer (RLS, grants, security boundaries). For function changes, follow its canonical RPC role contract, including effective privileges, caller tests, and coverage of new overloads. This skill covers the recurring workflow tasks. Read both.
For realistic optional Library data without changing schema history or the canonical base seed, use the opt-library skill. Return here when that work changes migrations, schemas, RLS, or grants.
Common mistake (read this first)
When asked to "merge migrations" or "consolidate", the temptation is to
collapse every supabase/migrations/* into a single canonical file.
This is wrong if any of those files have already been applied to a
deployed environment. Rewriting an applied migration:
- Diverges file content from what
supabase_migrations.schema_migrationsrecords as already-run. - Makes future
db resetproduce a different starting state for new contributors than what the existing environment holds. - Can silently drop columns, policies, or grants the live system needs.
Before merging anything, classify each migration:
| Class | Signal | Allowed action |
|---|---|---|
| Applied (production) | User confirms it's in production, OR file has been on main long enough to have shipped. |
Read-only. Never edit, never delete. |
| Applied (committed peers) | Tracked on the current branch but originated upstream (already on main / canary). |
Read-only. Never edit, never delete. |
| Local-only (this PR) | Newly added on the current working tree / branch, not yet merged to a deployed branch. | Free to merge, rename, delete, rewrite. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago Changed · -17 lines 812cf9ef5747
- 1mo ago Changed · +3 lines 892f96fe8ad5
- 2mo ago First seen · 272 lines · 106 tokens per session scan A c9ad2147f38d
database is a skill published in the GitHub repository gridaco/grida (2,693 stars, last pushed 11d ago), licensed Apache-2.0. It adds 106 tokens to every session and 2,802 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
explorer
Build and modify Studio Explorer surfaces, including notebooks, chats, SQL snippets, query cells, and their shared toolbar patterns.
database
Relational database authority — PostgreSQL, async ORM (SQLAlchemy 2 / asyncpg), Alembic schema migrations, Supabase Python and JS clients, query optimisation, index strategy, connection pooling, transaction patterns, and bulk operations across Python and Node stacks.
whodb
Work with WhoDB platform hosts and project resources via MCP, including multiple environments, or query databases directly in database-only MCP mode.
schema-designer
Help design database schemas, create tables, and plan data models. Activates when users ask to create tables, design schemas, or model data relationships.
graphjin-eval
Create, extend, run, baseline, and diagnose GraphJin agent evaluations through the graphjin eval CLI.
graphjin-env
Use when setting up a training or evaluation loop against a GraphJin agent environment — running the container, reading /health, driving episodes hosted or step-by-step or with your own agent over MCP, splitting train from eval, exporting trajectories, and deciding whether two rewards can be compared.