Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    PocketBase Gotchas

    1

    A scanner for PocketBase mistakes that fail silently — lost writes, filter injection, removed APIs and guest-writable rules.

    $9

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    PocketBase Gotchas

    PocketBase Gotchas

    Example session with this skill installed

    Check the PocketBase code in this project before we deploy.

    • Read your context and instructions
    • Compiled the pocketbase gotchas

    python3 scripts/pb_scan.py . (real output on a test project with planted bugs)

    src/orders.ts:5: warning: [bulk-autocancel] concurrent create/update (Promise.all / map / forEach) without { requestKey: null }
src/orders.ts:9: warning: [filter-injection] filter built with a template string — prefer pb.filter('field = {:v}', { v })
src/orders.ts:13: error: [admins-removed] `pb.admins` was removed in v0.23 — use pb.collection('_superusers')
pb_migrations/1_created_orders.js:2: warning: [public-rule] createRule is "" — anyone, including guests
pb_migrations/1_created_orders.js:2: warning: [public-rule] deleteRule is "" — anyone, including guests

5 finding(s): 1 error, 4 warning, 0 info

    Fixes

    LineFix
    orders.ts:5create(r, { requestKey: null }) — or pb.createBatch() if all rows must land together (enable Batch API in Settings first)
    orders.ts:9getFirstListItem(pb.filter('name = {:name}', { name }))
    orders.ts:13pb.collection('_superusers').authWithPassword(...) — server side only
    1_created_orders.jsdeleteRule: null (superusers), createRule: "@request.auth.id != ''"

    Also found in practice: on a 140,000-line production app the same scanner read the live pb_data/data.db and found 13 collections writable by guests that the migrations did not show.

    Next: fix, re-run until it exits 0, then test the rules logged in as a normal user — superusers bypass every rule.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    PocketBase often fails silently instead of throwing errors. This skill identifies and fixes critical implementation mistakes in code, migrations, and live database configurations that lead to data loss or security breaches.

    What it does

    • Scans for silent write failures by detecting concurrent SDK requests in loops or Promise.all missing the requestKey.
    • Audits API rules in both migration files and the live pb_data/data.db to catch public access gaps.
    • Finds auth legacy errors such as references to the removed pb.admins or superuser credentials leaked in frontend code.
    • Prevents filter injection by flagging string concatenation in queries and suggesting safe pb.filter placeholders.
    • Fixes React Strict Mode bugs involving shared useRef flags that cause discarded fetch data.

    How it works

    1. Run the bundled scanner using python3 scripts/pb_scan.py <project-dir> to generate a report of high-priority violations.
    2. Review the JS SDK implementation specifically for autoCancellation behavior and batch API settings.
    3. Verify collection schemas against code to ensure fields aren't being silently dropped due to typos.
    4. Audit API rules using a normal user context to confirm that empty rules aren't exposing private records.

    Frameworks & tools

    Works with PocketBase (v0.23+), the PocketBase JavaScript SDK, and React (Strict Mode). The included scanner requires Python 3.9+.

    Why this beats prompting it yourself

    Generic LLMs often suggest deprecated v0.22 patterns like pb.admins or miss that PocketBase returns a 200 OK even when a write fails due to a field typo. This skill uses a specialized static analysis script to verify the actual state of your data.db API rules, which prompts alone cannot see.

    Use cases

    • Auditing a project before deployment to ensure no superuser keys are in the browser bundle.
    • Debugging why only the last record in a loop is being saved to the database.
    • Hardening security rules after changing collections in the Admin UI.
    • Migrating older PocketBase implementations to the v0.23+ superuser and autodate patterns.

    Known limitations

    Does not support PocketBase versions earlier than v0.23. Cannot verify field names that are generated dynamically at runtime.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 3 days ago

    • Passed all security checks, Safe to install

    Requires

    Python 3.9+
    PocketBase (v0.23+)
    Python

    Listed3 days ago

    What's inside

    Frequently Asked Questions