Create and manage InsForge projects using the CLI. Handles authentication, project setup, database management, edge functions, storage, deployments, and secr...
The skill's instructions, capabilities, and examples are consistent with a CLI for managing InsForge projects; it performs high‑impact operations (deploy, DB queries, secrets access, and can install packages) but nothing in the bundle contradicts its stated purpose.
评估建议
This appears to be a coherent CLI skill for managing InsForge projects, but it performs high-impact operations. Before using or allowing automated agents to run it, consider:
- Prefer interactive OAuth login rather than supplying INSFORGE_EMAIL/INSFORGE_PASSWORD in the environment or CI. Passwords and tokens referenced by the docs are sensitive and will be stored at ~/.insforge/credentials.json.
- Review any npx package (e.g., `npx skills add insforge/agent-skills`) before it runs; installing...
详细分析 ▾
✓用途与能力
The name/description (InsForge CLI for projects, DB, functions, storage, deployments, secrets) align with the commands and references provided. No unrelated credentials, binaries, or install steps are requested by the skill metadata. The CLI operations described (login, create, deploy, db query, secrets) match the stated purpose.
ℹ指令范围
The SKILL.md instructs the agent for many high-impact actions that are appropriate for a CLI: starting a local auth callback server, storing tokens in ~/.insforge/credentials.json, running raw SQL, exporting/importing DB, zipping and uploading a project directory, invoking edge functions, and retrieving secrets. These actions are expected for a CLI but can access or transmit sensitive local data if misused (e.g., including .env files in a deployment zip, running an unrestricted SQL query, or using non-interactive password login). The docs explicitly warn about excluding .env and other sensitive files, which mitigates but does not eliminate the risk.
ℹ安装机制
There is no install spec for the skill itself (instruction-only), which is low-risk. One instruction for project creation indicates the CLI will run `npx skills add insforge/agent-skills` to install agent skills into the project; installing code via npx is typical for scaffolding but introduces an execution-of-remote-package step that users should review before allowing.
ℹ凭证需求
The skill metadata declares no required environment variables, but the documentation references several sensitive env vars (INSFORGE_ACCESS_TOKEN, INSFORGE_PROJECT_ID, INSFORGE_EMAIL, INSFORGE_PASSWORD, ANON_KEY, INSFORGE_BASE_URL, etc.). Those are expected for a CLI that supports non-interactive login, environment overrides, and edge functions; however they are high-sensitivity values and the skill would be able to read and use them if present. Tokens are stored locally at ~/.insforge/credentials.json per the docs.
ℹ持久化与权限
The skill is not always-enabled and does not request elevated platform privileges. Typical side effects documented include writing .insforge/project.json in the project directory and installing agent skills under .agents/skills/insforge/, and storing credentials in ~/.insforge/credentials.json (0600). These are expected for a project-management CLI but do result in persistent files on disk and additions to the local project.
For writing application code with the InsForge SDK, use the insforge (SDK) skill instead, and use the insforge docs to get specific SDK documentation.
Non-Obvious Behaviors
Functions invoke URL: invoked at {oss_host}/functions/{slug} — NOT /api/functions/{slug}. Exits with code 1 on HTTP 400+.
Secrets delete is soft: marks the secret inactive, not destroyed. Restore with insforge secrets update KEY --active true. Use --all with secrets list to see inactive ones.
Storage delete-bucket is hard: deletes the bucket and every object inside it permanently.
db rpc uses GET or POST: no --data → GET; with --data → POST.
Schedules use 5-field cron only: minute hour day month day-of-week. 6-field (with seconds) is NOT supported. Headers can reference secrets with ${{secrets.KEY_NAME}}.
Common Workflows
Set up database schema
insforge db query "CREATE TABLE posts (
id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
title TEXT NOT NULL,
content TEXT,
author_id UUID REFERENCES auth.users(id),
created_at TIMESTAMPTZ DEFAULT now()
)"
insforge db query "ALTER TABLE posts ENABLE ROW LEVEL SECURITY"
insforge db query "CREATE POLICY \"public_read\" ON posts FOR SELECT USING (true)"
insforge db query "CREATE POLICY \"owner_write\" ON posts FOR INSERT WITH CHECK (auth.uid() = author_id)"
FK to users: always auth.users(id). RLS current user: auth.uid().
For writing application code with the InsForge SDK, use the insforge (SDK) skill instead, and use the insforge docs to get specific SDK documentation.
Non-Obvious Behaviors
Functions invoke URL: invoked at {oss_host}/functions/{slug} — NOT /api/functions/{slug}. Exits with code 1 on HTTP 400+.
Secrets delete is soft: marks the secret inactive, not destroyed. Restore with insforge secrets update KEY --active true. Use --all with secrets list to see inactive ones.
Storage delete-bucket is hard: deletes the bucket and every object inside it permanently.
db rpc uses GET or POST: no --data → GET; with --data → POST.
Schedules use 5-field cron only: minute hour day month day-of-week. 6-field (with seconds) is NOT supported. Headers can reference secrets with ${{secrets.KEY_NAME}}.
Common Workflows
Set up database schema
insforge db query "CREATE TABLE posts (
id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
title TEXT NOT NULL,
content TEXT,
author_id UUID REFERENCES auth.users(id),
created_at TIMESTAMPTZ DEFAULT now()
)"
insforge db query "ALTER TABLE posts ENABLE ROW LEVEL SECURITY"
insforge db query "CREATE POLICY \"public_read\" ON posts FOR SELECT USING (true)"
insforge db query "CREATE POLICY \"owner_write\" ON posts FOR INSERT WITH CHECK (auth.uid() = author_id)"
FK to users: always auth.users(id). RLS current user: auth.uid().
by