What is insforge-cli?

A guide for managing InsForge backend projects from the command line. A backend provides services such as databases, file storage, server code, and scheduled jobs.

Use it to create tables, run SQL, manage database migrations, deploy functions or frontend apps, manage file storage and secrets, schedule jobs, and inspect logs.

It gathers common backend setup and maintenance tasks into documented commands and checks.

How victorGPT/vibeusage configures Claude Code and Codex

Reuse

Borrowing it

Nothing to install: this file belongs to victorGPT/vibeusage. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/victorGPT/vibeusage/main/.agents/skills/insforge-cli/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/victorGPT/vibeusage

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/victorgpt/vibeusage/insforge-cli/github.svg)](https://agentmods.dev/skills/victorgpt/vibeusage/insforge-cli)

Your own site

<a href="https://agentmods.dev/skills/victorgpt/vibeusage/insforge-cli"><img src="https://agentmods.dev/badge/skills/victorgpt/vibeusage/insforge-cli/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/victorgpt/vibeusage/insforge-cli"><img src="https://agentmods.dev/badge/skills/victorgpt/vibeusage/insforge-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 216 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 6,286 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 133 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Privilege Escalation · line 61
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
medium MCP Rug Pull · line 22
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 30
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 31
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 34
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 35
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 44
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 71
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 72
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 73
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 76
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 77
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 78
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 79
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 80
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 82
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 83
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 84
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 85
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 86
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00216	$0.06286
Opus 5.5	$0.00086	$0.02514
Sonnet 5.5	$0.00043	$0.01257
Haiku 4.5	$0.00022	$0.00629

Measured 1mo ago against content hash 63a76eee8a0d, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

insforge-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

2 near-identical copies found in the catalogue:

insforge-cli — 88% identical, 689 lines differ
insforge-cli — 88% identical, 682 lines differ

.agents/skills/insforge-cli/SKILL.md · 516 lines

How it starts

The opening of the file, as written. The whole thing — 516 lines — stays where its author put it; the contents beside it link to each section on GitHub.

InsForge CLI

Command-line tool for managing InsForge Backend-as-a-Service projects.

Critical: Always Use npx (No Global Install)

NEVER install the CLI globally (npm install -g @insforge/cli). Always run commands via npx:

npx @insforge/cli <command>

This ensures the latest version is always used without global install issues (permissions, PATH, node version mismatches).

Session start — verify authentication and project:

npx @insforge/cli whoami    # verify authentication
npx @insforge/cli current   # verify linked project

If not authenticated: npx @insforge/cli login If no project linked: npx @insforge/cli create (new) or npx @insforge/cli link (existing)

Global Options

Flag	Description
`--json`	Structured JSON output (for scripts and agents)
`-y, --yes`	Skip confirmation prompts

All examples below use npx @insforge/cli. Never call insforge directly.

Exit Codes

Code	Meaning
0	Success
1	General error (e.g., HTTP 400+ from function invoke)
2	Not authenticated
3	Project not linked
4	Resource not found
5	Permission denied

Environment Variables

Variable	Description
`INSFORGE_ACCESS_TOKEN`	Override stored access token
`INSFORGE_PROJECT_ID`	Override linked project ID
`INSFORGE_EMAIL`	Email for non-interactive login
`INSFORGE_PASSWORD`	Password for non-interactive login

Commands

Authentication

npx @insforge/cli login — OAuth (browser) or --email for password login. See references/login.md
npx @insforge/cli logout — clear stored credentials
npx @insforge/cli whoami — show current user

Project Management

npx @insforge/cli create — create new project. See references/create.md
npx @insforge/cli link — link directory to existing project
npx @insforge/cli current — show current user + linked project
npx @insforge/cli list — list all orgs and projects
npx @insforge/cli metadata — show backend metadata (auth config, database tables, storage buckets, edge functions, AI models, realtime channels). Use --json for structured output. Run this first to discover what's configured before building features.

Read the full file on GitHub · 516 lines

Files

What ships with it

10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 516 lines · 216 tokens per session scan A 63a76eee8a0d

Subscribe to this mod's changes

insforge-cli is a skill published in the GitHub repository victorGPT/vibeusage (130 stars, last pushed 2mo ago), licensed MIT. It adds 216 tokens to every session and 6,286 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs Databases

event-store-design

Design and implement event stores for event-sourced systems. Use when building event sourcing infrastructure, choosing event store technologies, or implementing event persistence patterns.

wshobson/agents · 33 tokens

convex-explain-app

Explain an existing Convex app — data model + relationships, public vs internal functions, auth/ownership model, components, a request→data flow — read from the schema and function surface. Read-only.

openclaw/clawhub · 47 tokens

platform-custom-field-generate

Use when users create, generate, or validate Salesforce Custom Field metadata. Trigger on custom fields, field types, Roll-Up Summary, Master-Detail/Lookup relationships, formula fields, picklists, dependent (controlling) picklists, referencing a value set from a field, or scoping picklist values per record type; also…

forcedotcom/sf-skills · 139 tokens

field-service-sobject-create-configure

Headless 360 REST API deployment step for creating sObject records. Handles describe-based field discovery, required-field derivation, entity-relationship ordering, and composite graph transactions. Use this skill when a designer skill (or a user directly) needs to create sObject records after design confirmation…

forcedotcom/sf-skills · 74 tokens

durable-objects

Build, debug, or review Cloudflare Durable Objects code for persistent state and coordination.

fcakyon/claude-codex-settings · 22 tokens

nornicdb-grpc

Drive NornicDB over gRPC — the Qdrant-compatible surface (Collections, Points, Snapshots) plus the additive NornicSearch service. Use when ingesting via Qdrant SDKs, migrating from Qdrant, or running hybrid text+vector search from a non-Bolt client. Covers connection, RPC catalog, collection→database mapping…

orneryd/NornicDB · 98 tokens

vibeusage: Skill for Claude Code