Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pinebasedev/svelteflare/auth-db-billingnpx skills add pinebasedev/svelteflare --skill auth-db-billinggit clone --depth 1 https://github.com/pinebasedev/svelteflareWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pinebasedev/svelteflare/auth-db-billing)<a href="https://agentmods.dev/skills/pinebasedev/svelteflare/auth-db-billing"><img src="https://agentmods.dev/badge/skills/pinebasedev/svelteflare/auth-db-billing.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00172 | $0.02715 |
| Opus 5 | $0.00086 | $0.01358 |
| Sonnet 5 | $0.00034 | $0.00543 |
| Haiku 4.5 | $0.00017 | $0.00271 |
Grade A, and why
auth-db-billing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 380 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auth / DB / Billing
Backend product systems for the svelteflare monorepo. All server logic lives in apps/api (Hono Worker). The SvelteKit app (apps/web) is a pure SPA with ssr = false — it has no +page.server.ts or hooks.server.ts. Every authenticated action, DB query, and billing operation goes through the Hono API.
Architecture quick-map
apps/api/src/
auth.ts ← Better Auth singleton factory (getAuth)
db/
schema.ts ← Drizzle schema (all tables)
database.ts ← DB singleton factory (getDb)
middleware/
auth.ts ← authMiddleware — resolves session on every request
authorization.ts ← requireAuthenticated, requireEntitled
subscription.ts ← subscriptionMiddleware — resolves isEntitled
rateLimit.ts ← rate limits differ by subscription tier
routes/
index.ts ← route groups (public / authenticated / admin)
auth.ts ← passes all /v1/auth/* to Better Auth handler
apps/web/src/lib/
authClient.ts ← Better Auth client (browser-side)
api.ts ← Hono RPC client (hc<AppType>)
Better Auth
How auth is initialized
getAuth(db, env) in apps/api/src/auth.ts is a singleton factory. It takes the Drizzle DB instance and Cloudflare env bindings. Never call betterAuth() directly in a route — always use getAuth.
Active plugins:
emailOTP— 6-digit OTP for email verification, 15-min expiry@better-auth/stripe— creates Stripe customer on signup, manages subscriptions- Email/password (requires email verification before login)
- Google OAuth (
disableImplicitSignUp: true— must sign up first)
No org/role/team plugins are active. The current auth model is single-user with subscription tiers only.
Session access in Hono routes
authMiddleware runs on every request and sets these on the Hono context:
c.get("user") // User object | null
c.get("session") // Session object | null
c.get("db") // Drizzle DB instance (set here for convenience)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 380 lines · 172 tokens per session scan A 10f4438d9d26
auth-db-billing is a skill published in the GitHub repository pinebasedev/svelteflare (47 stars, last pushed 1mo ago), licensed MIT. It adds 172 tokens to every session and 2,715 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
data-table
DiceUI data-table system for building production-ready data tables with server-side filtering, sorting, and pagination. Based on TanStack Table + nuqs URL state + Drizzle ORM backend. Use this skill whenever building, modifying, or debugging data tables — whether adding columns, filters, sort controls, server-side…
postgres-drizzle
Proactively apply when creating APIs, backends, or data models. Triggers on PostgreSQL, Postgres, Drizzle, database, schema, tables, columns, indexes, queries, migrations, ORM, relations, joins, transactions, SQL, drizzle-kit, connection pooling, N+1, JSONB, RLS. Use when writing database schemas, queries, migrations…
changelog-writer
This skill should be used when the user asks to "add a changelog entry", "write changelog", "audit changelog", "review changelog", "check changelog entries", or is editing docs-mintlify/changelog.mdx. Enforces a consistent, reader-facing voice and cuts implementation trivia.
add-media
This skill should be used when the user asks to "add a movie", "add a vinyl", "add to my collection", "add physical media", "add a Blu-ray", "add a CD", or "bought these records". It handles both movies (via TMDb/Trakt) and music (via Discogs).
media-search
This skill should be used when the user asks to "search for a movie", "find a record on Discogs", "look up a film", "search TMDb", "search Discogs", "what's the TMDb ID for", "what's the Discogs ID for", or wants to look up media metadata before adding it to the collection.
multiworker-workflow
Repo-root commands, typegen and typecheck cadence, lint, deploy, adding packages with bun, and Alchemy app layout. Use at the start of a task, before PR, or when choosing turbo/typegen commands.