PowerSync Agent Skills

Agent skills that help developers build applications with PowerSync.

Available Skills

Skill	Description
PowerSync	Comprehensive best practices for PowerSync Agent Skills. It includes all of the necessary topics from the SDKs, Service and debugging

PowerSync skills follow the Agent Skills specification.

Installation

Skills.sh

npx skills add powersync-ja/agent-skills

Claude Code

/plugin marketplace add powersync-ja/agent-skills
/plugin install powersync-skills

Usage

Once skills are installed, agents will automatically use relevant information when working on tasks relating to PowerSync.

A few examples:

Migrate my sync rules to sync streams.

Write sync streams that download all user tasks and make sure the data is only available on the device for one week.

Update my list to use a reactive watch query so users can see updates in real-time.

Suggest sync streams based on my current schema, where the user should only sync projects for tenant that they belong to.

Add an upload endpoint to my backend API that accepts write operations from client applications.

Contributing

We welcome contributions from the community to improve PowerSync AX. Please see CONTRIBUTING.md for details.

Verifying changes with snyk-agent-scan

skills.sh surfaces third-party security audits for this skill (Snyk, Socket, Gen Agent Trust Hub). Snyk's agent-scan flags secret-looking strings and credential-handling wording, so after changing any file under skills/, run it and confirm it reports zero issues.

With a free Snyk account (get a token at app.snyk.io/account; requires uv):

export SNYK_TOKEN=<your-token>
uvx snyk-agent-scan@latest scan skills/powersync --json

Without a Snyk account, use the rate-limited demo endpoint behind Snyk's Skill Inspector:

SNYK_CLI_USE=true uvx snyk-agent-scan@latest scan skills/powersync \
  --analysis-url "https://labs.snyk.io/experiments/skill-scan/api/agent-scan/analysis-machine" \
  --json

If uv is not available, pip install snyk-agent-scan into a virtualenv and run the same snyk-agent-scan scan ... command.

The scan passes when the JSON output contains an empty issues array. Known false-positive triggers to avoid in skill content:

• Connection strings with an inline password, i.e. user:password@ between the scheme and the host. Placeholders such as <user> or {user} still trigger it. Use user@host URIs and supply the password via a separate password: !env ... field.
• Hex strings of 20+ characters. Link to main or a tag instead of pinning commit SHAs, and zero out most characters in example IDs (e.g. 69c3d0350000000000000001).
• Literal credential values, even public defaults such as password: postgres. Use !env references.
• Wording that reads as credential harvesting, such as "persist credentials immediately" or "write all keys to disk". Frame the same guidance as keeping credentials in .env instead of hardcoding them.

Also run node scripts/validate.mjs before pushing. CI enforces it, and it includes its own check for inline credentials in example URIs.