Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/weiyi88/cc-code/vercel_supabase_deploymentnpx skills add weiyi88/cc-code --skill vercel_supabase_deploymentgit clone --depth 1 https://github.com/weiyi88/cc-codeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00084 | $0.01572 |
| Opus 5 | $0.00042 | $0.00786 |
| Sonnet 5 | $0.00017 | $0.00314 |
| Haiku 4.5 | $0.00008 | $0.00157 |
Grade A, and why
vercel_supabase_deployment scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**不能用直连**(中国网络 DNS 解析失败),必须用 REST API + curl。 Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
result = subprocess.run([ How it starts
The opening of the file, as written. The whole thing — 193 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vercel + Supabase 一键部署
前置条件(用户需提前完成)
- 本地
.env已配置(我直接读取,无需用户手动提供) - Supabase Access Token(
sbp_开头),用户在对话中提供 - GitHub 远程仓库已配置(
git remote -v可见) - Vercel CLI 已本地登录(
vercel whoami可用) - GitHub OAuth App Callback URL 已改为新生产域名(唯一需要用户手动操作的步骤)
部署流程
Step 1:读取环境配置
cat .env
从 .env 提取:
DATABASE_URL(Supabase Transaction Pooler,端口 6543)DIRECT_URL(Supabase Direct Connection,端口 5432)NEXTAUTH_URL(生产域名)- 其他所有变量
从 DIRECT_URL 解析出 Supabase Project Ref(格式:db.<ref>.supabase.co)
Step 2:提取本地 PostgreSQL Schema
pg_dump -h localhost -U <本地DB用户> -d <本地DB名> \
--schema-only --no-owner --no-acl \
-f .cc_code/scripts/schema_export.sql
注意:用户名不是
postgres,是本地系统用户(如blue_focus)。如果失败,用psql -l查看实际用户。
Step 3:通过 Supabase Management API 导入 Schema
不能用直连(中国网络 DNS 解析失败),必须用 REST API + curl。
import subprocess, re
access_token = "<用户提供的 sbp_ token>"
project_ref = "<从 DIRECT_URL 解析的 ref>"
with open(".cc_code/scripts/schema_export.sql") as f:
sql_content = f.read()
# 逐行状态机解析 SQL 语句(处理多行 + dollar-quoting)
statements = parse_sql_statements(sql_content)
for i, stmt in enumerate(statements):
payload = {"query": stmt}
result = subprocess.run([
"curl", "-s", "-X", "POST",
f"https://api.supabase.com/v1/projects/{project_ref}/database/query",
"-H", f"Authorization: Bearer {access_token}",
"-H", "Content-Type: application/json",
"-d", json.dumps(payload)
], capture_output=True, text=True)
print(f"[{i+1}/{len(statements)}] {'✓' if '\"error\"' not in result.stdout else '✗'}")
SQL 解析规则(状态机,非正则):
- 遇到
$$进入 dollar-quote 模式,直到下一个$$退出 - 遇到
'进入字符串模式,''是转义不退出 - 遇到
--跳过行注释 ;在普通模式下才是语句分隔符
Step 4:推送代码到 GitHub
git add -A
git commit -m "feat(deploy): deploy to Vercel + Supabase"
git push origin main
Step 5:配置 Vercel 环境变量
# 检查项目是否已关联
vercel ls
# 如果是新项目,先关联
vercel link
# 批量设置环境变量(从 .env 读取)
vercel env add DATABASE_URL production
vercel env add DIRECT_URL production
vercel env add AUTH_SECRET production
vercel env add AUTH_GITHUB_ID production
vercel env add AUTH_GITHUB_SECRET production
vercel env add SMTP_USER production
vercel env add SMTP_PASS production
vercel env add SMTP_FROM production
vercel env add NEXTAUTH_URL production
vercel env add THIRD_PARTY_AI_KEY production
vercel env add THIRD_PARTY_AI_BASE_URL production
vercel env add THIRD_PARTY_AI_MODEL production
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 193 lines · 84 tokens per session scan A 1eda7d1ca104
vercel_supabase_deployment is a skill published in the GitHub repository weiyi88/cc-code (5 stars, last pushed 7d ago), licensed MIT. It adds 84 tokens to every session and 1,572 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
alloydb-basics
Manages clusters, instances, and backups for AlloyDB for PostgreSQL, and integrates with AlloyDB Model Context Protocol (MCP) tools for automated database operations. Use when creating, configuring, or administering AlloyDB databases. Do NOT use for general PostgreSQL instances (e.g. Cloud SQL) or other GCP databases.
azure-resource-manager-postgresql-dotnet
Azure PostgreSQL Flexible Server SDK for .NET. Database management for PostgreSQL Flexible Server deployments. Use for creating servers, databases, firewall rules, configurations, backups, and high availability. Triggers: "PostgreSQL", "PostgreSqlFlexibleServer", "PostgreSQL Flexible Server", "Azure Database for…
stripe-projects
Use when the user wants to provision infrastructure or third-party services using Stripe Projects. Triggers: "I need a database", "set up auth", "add caching", "give me a Postgres", "provision Redis", "I need hosting", "add a vector DB", "get me an API key for X", "get credentials for X", "sign up for a service", "set…
cloudsql-idle-connection-timeout
Fix psycopg2 "could not receive data from server: Operation timed out" or "connection already closed" errors when using Cloud SQL with long-running Python scripts. Use when: (1) psycopg2.OperationalError after a period of no DB activity, (2) DB connection works initially but fails after a non-DB phase (API calls, file…
neon-postgres-branches
Choose and create the right Neon branch type for testing and development. Use when users ask about Neon branching, migration testing with real data, isolated test environments, schema-only branch workflows for sensitive data, resetting a branch from its parent, branch expiration and CI/CD branch lifecycles, or branch…
aws-essentials
Use when standing up the core AWS surface a small product needs: hardening a fresh account, a private S3 bucket, encrypted RDS Postgres, ECS Fargate vs EC2, CloudFront + OAC, or scoping an IAM policy to least privilege. NOT the CI pipeline that ships the container (that is deployment), NOT app-code access-control…