Borrowing it
Nothing to install: this file belongs to vscarpenter/gsd-task-manager. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/vscarpenter/gsd-task-manager/main/.agents/skills/pb-collection/SKILL.mdgit clone --depth 1 https://github.com/vscarpenter/gsd-task-managerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vscarpenter/gsd-task-manager/pb-collection)<a href="https://agentmods.dev/skills/vscarpenter/gsd-task-manager/pb-collection"><img src="https://agentmods.dev/badge/skills/vscarpenter/gsd-task-manager/pb-collection.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.01537 |
| Opus 5 | $0.00036 | $0.00768 |
| Sonnet 5 | $0.00014 | $0.00307 |
| Haiku 4.5 | $0.00007 | $0.00154 |
Grade A, and why
pb-collection scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pb-collection — End-to-end PocketBase tasks-collection field change
This skill walks through every place a field touches when added to the synced tasks collection. Skipping any step has bitten us before — the order matters.
When to invoke
User says any of:
- "Add a
<field>to tasks" - "Sync
<field>across devices" - "PocketBase needs
<field>" - "Update the tasks schema"
Do NOT invoke for local-only Dexie fields (those don't need the PB layers).
Prerequisites — verify before touching code
- Read
AGENTS.md→ "PocketBase v0.23+ Gotchas" section. The gotchas below are condensed but the source of truth is there. - Confirm the user has the PocketBase admin password handy (needed to run
scripts/setup-pocketbase-collections.sh). - Confirm the field is not a system field name (
id,created,updated,collectionId,collectionName). - Confirm field type is supported by both Dexie and PocketBase:
text,number,bool,json,date. Never userelationto_pb_users_auth_(placeholder doesn't resolve at runtime).
Step order (do not reorder)
1. Update Zod schema — lib/schema.ts
- Add the field to the
taskSchema(andtaskInputSchemaif user-settable). - Use
.safeParse()callers; if this is a user-input path, the schema must already be wired to a safeParse boundary. - For optional fields, default to a sensible value (
.optional().default(...)) so legacy tasks parse without error. - Update both
exportSchema(.strict()) andimportSchema(.strip()).
2. Update task-mapper — lib/sync/task-mapper.ts
- Add the camelCase ↔ snake_case mapping. PocketBase uses snake_case; the app uses camelCase.
- Both directions:
mapToRemote()andmapFromRemote(). - Test the mapper round-trip in
tests/data/task-mapper.test.ts.
3. Update PocketBase collection — scripts/setup-pocketbase-collections.sh
- Add the field to the
taskscollection definition in the script. - If the field needs to be sortable/filterable, add a custom index — but the index must reference the new field, NEVER
createdorupdated. - Run the script against
https://api.vinny.io(requires_superusersadmin auth — endpoint is/api/collections/_superusers/auth-with-password, not/api/admins/). - Verify the field appears in PB admin UI before continuing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 111 lines · 71 tokens per session scan A b0b627f22f07
pb-collection is a skill published in the GitHub repository vscarpenter/gsd-task-manager (25 stars, last pushed yesterday), licensed MIT. It adds 71 tokens to every session and 1,537 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
organize-database
Transform unstructured Notion pages into a well-designed database with proper schema and migration.
lastest
Run visual regression tests, review screenshot diffs, and manage baselines on a Lastest instance via the @lastest/mcp-server MCP tools.
Lastest design system
Visual + content rules for Lastest, the free open-source visual regression testing platform. Anchored on the Delta Mark logo + 5-stop split-complementary palette.
api-canvas
DataCanvas primitive reference — a Tier 3 SQL/analytical workspace for tabular MCP servers, backed by DuckDB. Use when registering tables from upstream APIs, running ad-hoc SQL across them, and exporting results. Covers the acquire → register → query → export flow, per-table TTL, the token-sharing pattern for…
lastest
Lastest is a visual regression testing platform. It records browser tests, runs them via Playwright, diffs screenshots, and uses AI to classify changes. Available as an MCP server for AI agent integration.
api-canvas
DataCanvas primitive reference — a Tier 3 SQL/analytical workspace for tabular MCP servers, backed by DuckDB. Use when registering tables from upstream APIs, running ad-hoc SQL across them, and exporting results. Covers the acquire → register → query → export flow, per-table TTL, the token-sharing pattern for…