Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add receptron/mulmoterminal --skill actions-supabasegit clone --depth 1 https://github.com/receptron/mulmoterminalWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/receptron/mulmoterminal/actions-supabase)<a href="https://agentmods.dev/skills/receptron/mulmoterminal/actions-supabase"><img src="https://agentmods.dev/badge/skills/receptron/mulmoterminal/actions-supabase/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/receptron/mulmoterminal/actions-supabase"><img src="https://agentmods.dev/badge/skills/receptron/mulmoterminal/actions-supabase.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.01070 |
| Opus 5.5 | $0.00016 | $0.00428 |
| Sonnet 5.5 | $0.00008 | $0.00214 |
| Haiku 4.5 | $0.00004 | $0.00107 |
Grade A, and why
blueprint-from-collection-actions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Actions and ingests, as features
Read .blueprint/actions.json (written with the spec, and agreed when the spec was approved). If it does not exist, the
source had no actions or ingests: stop. Each entry names an action (books.actions.tidy) or an ingest (books.ingest),
what it was (kind) and what was decided (decision). The original instructions are in
.blueprint/source/collections/<slug>/templates/.
For every feature, build it as below, unless an earlier step already built it because a must-have needed it: then
check it against its entry and give it its test here instead of building it a second time.
- mutate — a Postgres function the screen calls with
supabase.rpc, in a migration, and a button on the record's screen. It runs as the caller (security invoker), so the table's RLS still decides; itsrequireis checked inside it, itssetis the change it makes, itsparamsare its arguments. - chat / agent — read the template: it says what the agent was asked to do. Build that as the app's own logic.
Where a step genuinely needs a language model (summarising, classifying, drafting text), call the Claude API from a
Supabase Edge Function (
supabase/functions/<name>/), never from the browser: the key is the function secretANTHROPIC_API_KEY— locally insupabase/functions/.env(in.gitignore; the check fails otherwise), in production set by the person withyarn supabase secrets set ANTHROPIC_API_KEY=…. Never write the key's value yourself: tell the person, in the README, where to put their own key. The function checks the caller's session before doing anything. If the app uses functions,db:startmust not leave outedge-runtime. - ingest (rss / atom / http-json) — a job that fetches the source, maps each item as the ingest's
mapsays, and inserts or updates records by theidFromit names, never duplicating. Put it in an Edge Function, run it on the schedule the ingest declares withpg_cron+pg_net(a migration), and say in the README how to run it once by hand. An ingest of kindagentis built like an agent action.
Tests in test/actions.test.ts, one per feature, each with the entry's name in the title of its it(…) / test(…)
(it("books.actions.tidy: summarises", …)) — with it / test imported from vitest in that file (import { it } from "vitest"); the check reads titles only from
calls to those imports, so a global it, a helper of the same name, a comment or a title built at run time does not count, and neither does a describe(…) name (it("tidy") inside
describe("books.actions") is not titled books.actions.tidy: write the whole name in every test's own title):
walk the real flow against the local stack and read back what changed. Never call the network in a test: a model call
goes through a client the test replaces with a stand-in, and an ingest job takes the fetch it uses as an argument, so
the test hands it a fixture instead. The tests must pass with no API key set.
For every manual: a section in README.md whose heading names the entry (## books.actions.tidy) and which says,
step by step, what a person does instead. For every drop: nothing to build; the spec already says why.
Done when the check passes: .blueprint/actions.json matches the source, every feature has a test titled with its
name, every manual has a README heading naming it, supabase/functions/.env (if any) is ignored, and yarn build
and yarn test succeed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed · +2 lines 3fa2bffdc2d8
- 16d ago First seen · 52 lines · 40 tokens per session scan A e3330c6b7986
blueprint-from-collection-actions is a skill published in the GitHub repository receptron/mulmoterminal (239 stars, last pushed today), licensed MIT. It adds 40 tokens to every session and 1,070 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-01.
Other skills, from other repositories
api-baas-neon
Serverless PostgreSQL with branching, autoscaling, and edge-compatible driver.
api-database-postgresql
Direct PostgreSQL access with node-postgres (pg) -- connection pools, parameterized queries, transactions, streaming, LISTEN/NOTIFY, error handling.
senior-backend
Backend development with Node.js/Express/Fastify and PostgreSQL. Use when designing REST or GraphQL APIs, optimizing database queries, implementing authentication, building microservices, handling migrations, or reviewing backend code.
azure-postgres-ts
Connect to Azure Database for PostgreSQL Flexible Server from Node.js/TypeScript using the pg (node-postgres) package. Use for PostgreSQL queries, connection pooling, transactions, and Microsoft Entra ID (passwordless) authentication. Triggers: "PostgreSQL", "postgres", "pg client", "node-postgres", "Azure PostgreSQL…
supabase
Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies…
butterbase
AI-native, open-source backend-as-a-service with a built-in Model Context Protocol server. Postgres, auth, storage, functions, AI gateway.