Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tale-project/tale --skill create-migrationgit clone --depth 1 https://github.com/tale-project/taleWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tale-project/tale/create-migration)<a href="https://agentmods.dev/skills/tale-project/tale/create-migration"><img src="https://agentmods.dev/badge/skills/tale-project/tale/create-migration/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tale-project/tale/create-migration"><img src="https://agentmods.dev/badge/skills/tale-project/tale/create-migration.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Prompt Injection · line 49 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00173 | $0.02398 |
| Opus 5.5 | $0.00069 | $0.00959 |
| Sonnet 5.5 | $0.00035 | $0.00480 |
| Haiku 4.5 | $0.00017 | $0.00240 |
Grade A, and why
create-migration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Backend database migrations (0.5)
Every database-shape change ships as a numbered SQL file under
services/platform/backend/db/migrations/ (a backfill that must decide with the app's own code
is a numbered .ts data migration there — see below). runBootMigrations
(backend/db/migrate.ts) applies them at every backend boot, in filename order, each in its
own transaction, tracked by filename in app_migrations — all inside one session-scoped advisory
lock, so N concurrently booting containers (api + worker, or scaled replicas) apply everything
exactly once while the others wait.
There is no tale migrate up/down, no versioned framework, no rollback ledger: a deployed image
is at its own schema by construction. tale migrate means something else entirely — re-provision
built-in defaults into every org (/api/control/provision).
The 0.4 Convex versioned-migration framework (
defineDbMigration,migrations:runAll,tale migrate status/up/down, the world corpus) is retired. 0.5 is a fresh instance and carries no data forward from it.
The authoring contract
services/platform/backend/db/migrations/NNNN_snake_case_subject.sql
NNNNis the next zero-padded number, no gaps, no reuse. Filename order IS apply order, and the filename is the identity recorded inapp_migrations— never rename a file that has shipped, or every existing deployment re-applies it.- One subject per file. The name says what it is (
0057_competence_records.sql), not what you did (0057_fix.sql). - Everything lands in the
appschema (CREATE TABLE app.x), the app's own namespace. Better Auth owns the unqualified tables ("user","member","organization") and migrates itself; pg-boss ownspgboss. Never write either from here. - Comment the WHY at the top, and on any column whose meaning is not obvious from its name —
these files are the schema's documentation. Look at
0057_competence_records.sqlfor the house style (what the table is for, which rule an index encodes, why a row is retained rather than deleted). - Timestamps are
bigintepoch-millis columns named*_at_ms(the app's clock is JS).id text PRIMARY KEY DEFAULT gen_random_uuid()is the standard key.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 16d ago Changed · +2 lines 91cc83ff2f3f
- 18d ago Changed · +47 lines · +21 tokens per session 268d1b0aac65
- 1mo ago First seen · 94 lines · 152 tokens per session scan A 40cf9f18ac12
create-migration is a skill published in the GitHub repository tale-project/tale (35 stars, last pushed today), licensed MIT. It adds 173 tokens to every session and 2,398 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
stripe-projects
Use when the user wants to provision infrastructure or third-party services using Stripe Projects. Triggers: "I need a database", "set up auth", "add caching", "give me a Postgres", "provision Redis", "I need hosting", "add a vector DB", "get me an API key for X", "get credentials for X", "sign up for a service", "set…
output-dev-credentials
Store and reference encrypted secrets in Output SDK workflows using @outputai/core/credentials. Use when integrating API keys, database passwords, or third-party tokens.
pn-backend-architecture
Scalable system design, database schemas, API contracts, microservices patterns. Use when designing APIs, DBs, or infrastructure before or during backend implementation.
pn-supabase
Supabase patterns for Row Level Security, realtime subscriptions, Edge Functions, storage, and auth helpers. Use when building features on a Supabase-backed project.
upstash-ratelimit-js
Rate limiting for serverless and edge apps with the @upstash/ratelimit TypeScript/JavaScript SDK backed by Upstash Redis. Use when adding a rate limiter or throttling to an API route, Next.js middleware, Vercel Edge, Cloudflare Workers, or any HTTP endpoint; returning 429 Too Many Requests; choosing between fixed…
qdrant
Vector search engine for production RAG systems.