insforge-backend-advisor
Use this skill for proactive backend health audits in an InsForge project — security misconfigurations, performance regressions, and system health issues surfaced by diagnose advisor, plus the backend-side deep-dives that pair with each advisor issue. Also use this skill when a user reports backend-wide performance degradation (high CPU/memory, all responses slow, connection pool exhaustion, lock contention) without a single failing request. Trigger on requests like "health check", "audit my backend", "review security", "check RLS policies", "find slow queries", "backend performance review", "high CPU/memory", "everything is slow", "EC2/database/system health", or pre-launch readiness audits. For reactive runtime errors with a single concrete failing request (SDK error objects, HTTP 4xx/5xx, function failures, deploy failures), use insforge-debug instead.
- Installs
- 402
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/insforge/insforge-skills --skill insforge-backend-advisor- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads insforge-backend-advisor automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
InsForge Backend Advisor
Proactive backend health auditing for InsForge projects. This skill drives the diagnose advisor scan — security misconfigurations, performance regressions, and system health issues — then pairs each issue category with hands-on commands to verify and reproduce findings before changing anything.
Always use npx @insforge/cli — never install the CLI globally.
When to Use This Skill vs insforge-debug
| You should be here when... | You should be in insforge-debug when... |
|---|---|
| Doing a periodic health check / pre-launch audit | A specific request just returned an error or unexpected status |
| Reviewing security posture (RLS, secrets, auth config) | A user can't log in / token expired / OAuth callback failing |
| Looking for slow queries, bloat, missing indexes proactively | A specific endpoint is slow right now and the user pasted the URL |
| Backend-wide degradation: high CPU/memory, all responses slow, connection pool exhausted, locks contending | A single request failed or timed out |
| "What's wrong with my backend?" without a concrete symptom | "Why did THIS request fail?" with a concrete symptom |
If you're not sure which side you're on: a concrete error/URL/status code → insforge-debug. A general "look for problems" → here.
Run a Scan First
Every workflow in this skill starts from a fresh advisor scan. The scan aggregates checks across security, performance, and health categories and ranks each issue by severity.
npx @insforge/cli diagnose advisor
By default the latest scan summary plus up to 50 issues is shown. Narrow with --severity and --category:
# Only critical issues (start here in any audit)
npx @insforge/cli diagnose advisor --severity critical
# Security category only
npx @insforge/cli diagnose advisor --category security
# JSON for full issue payload (ruleId, affectedObject, recommendation, isResolved)
npx @insforge/cli diagnose advisor --json
Each issue object includes ruleId, severity, category, title, description, affectedObject, and recommendation. Read affectedObject to know which table/policy/secret/resource the issue is about before drilling in.
Note:
diagnose advisorrequires InsForge Platform login. It is not available on projects linked via--api-key.
Quick Triage
Match the issue's category (after running a scan) or the user's symptom (if they came in cold) to a deep-dive section.
| Source | Maps to | Deep-dive section |
|---|---|---|
Advisor category=security | RLS, exposed config, secrets | Security Audit |
Advisor category=performance | Slow queries, indexes, bloat | Performance Audit |
Advisor category=health | Connections, locks, system metrics | System Health Audit |
| Symptom: "everything is slow", high CPU/memory, all responses slow | Backend-wide degradation | System Health Audit |
| Symptom: "this query is slow" (without a single failing URL) | Query-level performance | Performance Audit |
For a mixed report or a "what should I fix first?" question, work through critical issues across all categories before warnings.
Security Audit
Triggers: advisor issues with category=security, or a request like "review RLS", "audit auth config", "any secrets exposed?".
Steps
- List security issues from the latest scan:
npx @insforge/cli diagnose advisor --category security
- For each RLS-related issue (
affectedObjectis a table name or policy), inspect the live policies on that table:
npx @insforge/cli db policies
- Verify the project's auth configuration matches expectation (providers enabled, redirect URLs, JWT settings):
npx @insforge/cli metadata --json
- For secrets-related issues, list current secrets (names only — values are not printed unless explicitly requested) and check for ones marked
--reservedor with expired--expires:
npx @insforge/cli secrets list --all
- If an advisor
ruleIdflags exposure (e.g., public bucket holding sensitive data, RLS disabled on a user-data table), confirm the affected object's actual state before recommending a change — do not blindly apply advisor's recommendation.
Information gathered: active RLS policies, auth providers and redirect URLs, secret inventory, ground-truth state of every affectedObject flagged by advisor.
Performance Audit
Triggers: advisor issues with category=performance, or a request like "find slow queries", "do I have missing indexes?", "is my DB bloated?".
Steps
- List performance issues:
npx @insforge/cli diagnose advisor --category performance
- Pull the full database performance picture — slow queries, index efficiency, bloat, cache hit ratio, size:
npx @insforge/cli diagnose db --check slow-queries,index-usage,bloat,cache-hit,size
- For a specific table flagged by
affectedObject, inspect it directly with SQL:
npx @insforge/cli db query "SELECT pg_size_pretty(pg_total_relation_size('<table>')) AS total_size, pg_size_pretty(pg_indexes_size('<table>')) AS indexes_size"
- Cross-check against EC2 instance metrics — a "slow query" report can also be CPU/memory pressure, not the query itself:
npx @insforge/cli diagnose metrics --range 6h
- If the issue is index-related, look at actual index usage via postgres logs to see whether the missing index is being hit at runtime:
npx @insforge/cli logs postgres.logs --limit 50
Information gathered: slow query plans, index usage, table bloat, cache hit ratio, current EC2 resource utilization, postgres query patterns.
System Health Audit
Triggers: advisor issues with category=health, or a request like "is my backend healthy?", "any locks?", "connection pool OK?", "EC2 looking right?".
Steps
- List health issues:
npx @insforge/cli diagnose advisor --category health
- Run the full database health sweep — connections, locks, and other live state:
npx @insforge/cli diagnose db --check connections,locks
- Pull EC2 instance metrics over a meaningful window (default 1h; widen for trend):
npx @insforge/cli diagnose metrics --range 24h
- Aggregate error logs to see whether health issues correlate with recent error spikes:
npx @insforge/cli diagnose logs
- If connection-pool exhaustion or lock contention is flagged, drill into postgres logs around the scan time:
npx @insforge/cli logs postgres.logs --limit 100
Information gathered: connection pool state, lock contention, CPU/memory/disk/network metrics with trend, error log summary, postgres-level activity.
Iteration Workflow
Advisor issues persist across scans until resolved (issue objects carry isResolved). The recommended audit loop:
- Scan —
diagnose advisor --severity criticalto get the working set. - Drill — for each issue, use the relevant deep-dive section above to verify the live state matches advisor's report.
- Decide — only proceed to a fix after you've confirmed the issue is real. Advisor surfaces rule violations; whether they're business-relevant is a judgment call.
- Fix — apply the change (RLS edit, index, query rewrite, etc.) via the
insforge-cliskill (npx @insforge/cli ...commands). - Re-scan — run
diagnose advisoragain. The fixed issue should appear withisResolved: trueon the next scheduled scan, or drop off the active set.
Do not rely on the same scan twice across a fix — always re-scan after applying changes.
Command Quick Reference
Advisor scan
npx @insforge/cli diagnose advisor [--severity critical|warning|info] [--category security|performance|health] [--limit <n>] [--json]
Default --limit is 50. --json returns scan summary + full issue objects (with ruleId, recommendation, isResolved).
Backend deep-dive
# Database health checks
npx @insforge/cli diagnose db [--check connections,slow-queries,bloat,size,index-usage,locks,cache-hit]
# EC2 instance metrics
npx @insforge/cli diagnose metrics [--range 1h|6h|24h|7d] [--metrics <list>]
# Aggregate error logs from all sources
npx @insforge/cli diagnose logs [--source <name>] [--limit <n>]
# Postgres-level logs
npx @insforge/cli logs postgres.logs --limit 50
Supporting
# Project metadata (auth config, tables, buckets, functions, RLS policies)
npx @insforge/cli metadata --json
# Live RLS policies
npx @insforge/cli db policies
# Ad-hoc SQL against the project
npx @insforge/cli db query "<sql>"
# Secrets inventory
npx @insforge/cli secrets list --all
For reactive debugging (a concrete error, status code, or failing URL), switch to insforge-debug.
FAQ
What does the insforge-backend-advisor skill do?
Use this skill for proactive backend health audits in an InsForge project — security misconfigurations, performance regressions, and system health issues surfaced by diagnose advisor, plus the backend-side deep-dives that pair with each advisor issue. Also use this skill when a user reports backend-wide performance degradation (high CPU/memory, all responses slow, connection pool exhaustion, lock contention) without a single failing request. Trigger on requests like "health check", "audit my backend", "review security", "check RLS policies", "find slow queries", "backend performance review", "high CPU/memory", "everything is slow", "EC2/database/system health", or pre-launch readiness audits. For reactive runtime errors with a single concrete failing request (SDK error objects, HTTP 4xx/5xx, function failures, deploy failures), use insforge-debug instead.
How do I install insforge-backend-advisor?
Run npx skills add https://github.com/insforge/insforge-skills --skill insforge-backend-advisor in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/insforge-backend-advisor/ (personal) or .claude/skills/insforge-backend-advisor/ (project).
Which AI agents can use insforge-backend-advisor?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is insforge-backend-advisor safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains insforge-backend-advisor?
It is published by insforge in insforge/insforge-skills. It has 402 recorded installs.
More from insforge/insforge-skills
insforge
insforge/insforge-skills
Use this skill when writing app code with InsForge or @insforge/sdk: database CRUD, auth, storage uploads/storage RLS, functions, OpenRouter AI, realtime, emails, Stripe or Razorpay payments, or pointing S3-compatible tooling (aws CLI, AWS SDKs, rclone, Terraform, boto3) at InsForge Storage. Trigger on requests like add auth, fetch data, upload files, make a bucket public, add checkout, sell subscriptions, or send email. For infrastructure, SQL migrations, CLI commands, or payment provider setup, use insforge-cli instead.
insforge-cli
insforge/insforge-skills
Use this skill whenever someone needs a backend, or a task touches InsForge backend or cloud infrastructure through the InsForge CLI: projects, SQL, migrations, RLS policies, functions, storage, backups, deployments, compute, secrets, config, schedules, logs, diagnostics, advisor scans and suppressions, import/export, AI/OpenRouter setup and usage overview, Stripe/Razorpay payments, Apify web scraping / data sources, PostHog product analytics, backend branches, organization membership (invite, leave, delete), agent memory (remember/recall project facts and decisions), reporting InsForge-side bugs or doc discrepancies (feedback), or CLI docs. For app code with InsForge or @insforge/sdk, use the insforge app-integration skill instead.
insforge-debug
insforge/insforge-skills
Use when diagnosing problems in an InsForge project — reactive failures (SDK error object, HTTP 4xx/5xx, gateway timeout 502/503/504, edge function failure or timeout, login/OAuth/auth errors, RLS denial, realtime channel issues, slow query on one endpoint, edge function or Vercel deploy failure), proactive audits (security/RLS review, performance/index review, system health check, pre-launch readiness), or when the user has an error but doesn't know where to start.
insforge-integrations
insforge/insforge-skills
Use when wiring an external auth provider (Clerk, Auth0, WorkOS, Kinde, Stytch, Better Auth) into InsForge for JWT-based RLS, or when adding the OKX x402 payment facilitator for onchain pay-per-use billing.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.