A skill your agent uses when uploading or downloading files, generating presigned URLs, configuring storage ACLs, or persisting file references (avatars, attachments, images) in a Butterbase app

MITAuto-check passedBackend & APIs

Install Storage

skills CLI
$ npx skills add butterbase-ai/butterbase-skills --skill storage -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install butterbase-ai/butterbase-skills storage --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/butterbase-ai/butterbase-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/storage .claude/skills/storage && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
storage
GitHub stars
534
Token cost
~2.1k tokens
SKILL.md length
808 words
Files
1
Skills in repo
39
Repo updated
First seen
Licence
MIT

At a glance

A skill your agent uses when uploading or downloading files, generating presigned URLs, configuring storage ACLs, or persisting file references (avatars, attachments, images) in a Butterbase app

  • Works in 8 steps: The mental model: object_id vs s3_key → The upload lifecycle → Generating download URLs → …
  • Downloading files
  • SKILL.md covers 1. The mental model: object_id…, 2. The upload lifecycle, 3. Generating download URLs and 4. Access control, plus 4 more sections
  • Calls curl; reaches s3.amazonaws.com

What it does

Storage is an agent skill from butterbase-ai/butterbase-skills. Use when uploading or downloading files, generating presigned URLs, configuring storage ACLs, or persisting file references (avatars, attachments, images) in a Butterbase app

Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering File uploads and storage. The repository describes itself as: Plugin for Butterbase.ai. The licence is MIT.

When your agent uses it

  • Downloading files
  • Generating presigned URLs
  • Configuring storage ACLs
  • Persisting file references (avatars

Example prompts

  • “/storage”

Workflow steps

8 steps, taken from the step headings in SKILL.md.

  1. The mental model: object_id vs s3_key
  2. The upload lifecycle
  3. Generating download URLs
  4. Access control
  5. Listing and deleting
  6. Quotas & error codes
  7. Common patterns
  8. Anti-patterns

What it can do on your machine

Read from SKILL.md and the folder at commit aa8ae69. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • curl

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • s3.amazonaws.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Storage loads about 2.1k tokens when it runs. Until then it costs about 46 tokens; SKILL.md has 808 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~46
When it runs · the whole SKILL.md, loaded when a task matches
~2.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from butterbase-ai/butterbase-skills at commit aa8ae69, republished under its MIT licence (© butterbase-ai). 808 words, ~2,066 tokens.

Download SKILL.mdSave it as .claude/skills/storage/SKILL.md (or your agent's skills folder).
name
storage
description
Use when uploading or downloading files, generating presigned URLs, configuring storage ACLs, or persisting file references (avatars, attachments, images) in a Butterbase app

Butterbase Storage

Butterbase stores files in S3 (or LocalStack in dev) and exposes them via presigned URLs. Every file gets a stable object_id (UUID) that you persist in your tables; URLs are generated on demand and expire.

All storage operations go through one tool: manage_storage with an action parameter.

ActionPurpose
upload_urlGenerate a 15-minute presigned PUT URL and reserve an object_id
download_urlGenerate a 1-hour presigned GET URL for a stored object
listList objects (scoped by caller's role)
deletePermanently remove an object from S3 + database
update_configToggle app-level publicReadEnabled and other storage settings

1. The mental model: object_id vs s3_key

FieldWhat it isWhen you use it
object_idUUID, stable, app-level handlePersist in your tables (e.g. users.avatar_id, posts.image_id)
s3_keyInternal bucket path like app_abc/user_uuid/file.jpgInternal only — never treat this as a URL

Critical: s3_key is not a URL. You cannot use it as <img src> or <a href>. Always store the object_id and resolve a fresh download URL at render time.


2. The upload lifecycle

A single upload is two HTTP calls and one DB insert in your app:

┌─────────────────────────┐
│ 1. manage_storage(      │  → returns { upload_url, object_id, expires_at }
│      action: upload_url)│
├─────────────────────────┤
│ 2. PUT file -> S3       │  → must include exact Content-Type header
├─────────────────────────┤
│ 3. INSERT INTO ...      │  → save object_id alongside the user/post/etc.
└─────────────────────────┘

If you skip step 3, the file lives in S3 but no row references it — an orphaned object counting against your quota. Always persist the object_id.

Step 1 — request an upload URL
js
manage_storage({
  app_id: "app_abc123",
  action: "upload_url",
  filename: "avatar.jpg",
  content_type: "image/jpeg",
  size_bytes: 245123,
  public: false                  // optional; default false
})

Returns:

json
{
  "upload_url": "https://s3.amazonaws.com/...",
  "object_id": "9c14b2e0-...",
  "expires_at": "2026-05-08T22:15:00Z"
}

The object_id is created immediately in the database; the file just hasn't been uploaded yet.

Step 2 — PUT the bytes

The Content-Type on the PUT must match exactly the content_type you sent in step 1. If it doesn't, S3 rejects the upload or stores the wrong MIME — breaking browser previews.

bash
curl -X PUT "{upload_url}" \
  -H "Content-Type: image/jpeg" \
  --data-binary @avatar.jpg

From the browser:

js
await fetch(uploadUrl, {
  method: "PUT",
  headers: { "Content-Type": file.type },
  body: file
});
Step 3 — persist the object_id
sql
UPDATE users SET avatar_id = $1 WHERE id = $2

Or via the auto-API / SDK — whatever your app uses for writes. Without this step, the file is unreachable.


3. Generating download URLs

Each call returns a fresh URL valid for 1 hour. Don't bake URLs into static HTML or long-lived caches — re-generate per render or per session.

js
manage_storage({
  app_id: "app_abc123",
  action: "download_url",
  object_id: "9c14b2e0-..."
})
// → { download_url: "https://s3.amazonaws.com/..." }

For lists with many files, resolve URLs in parallel:

js
const urls = await Promise.all(
  posts.map(p => getDownloadUrl(p.image_id))
);

If the caller is unauthorized, the response is 404 (not 403) — Butterbase deliberately hides existence to avoid leaking object IDs.


4. Access control

Three tiers, evaluated in order:

CallerWhat they can read
Service key (bb_sk_*)Everything in the app — RLS bypassed
End-user JWTFiles where (user_id === caller_id) OR object.public === true OR app.publicReadEnabled === true
Anonymous (no auth)Only public objects (and only if app access mode allows anon)
Per-object public flag

Set at upload time:

js
manage_storage({ app_id, action: "upload_url", filename, content_type, size_bytes, public: true })

Use this for one-off public files (a marketing image, a shared avatar) without flipping the whole app to public-read.

App-wide public read
js
manage_storage({
  app_id: "app_abc123",
  action: "update_config",
  publicReadEnabled: true
})

When true, any authenticated user in the app can download any file. Uploads and deletes stay user-scoped.

Storage ACL is hardcoded — you cannot layer Postgres RLS policies on top of storage_objects. If you need fine-grained custom rules, gate downloads through a serverless function instead of handing out direct presigned URLs.


Show full SKILL.md (330 more words)Show less

5. Listing and deleting

js
manage_storage({ app_id: "app_abc123", action: "list" })

Service key sees everything; end-user JWT sees only their own files. Each item has id, user_id, key, filename, content_type, size_bytes, created_at.

js
manage_storage({ app_id: "app_abc123", action: "delete", object_id: "9c14b2e0-..." })

Permanently removes the S3 object and DB row. Clear foreign-key references first (e.g. UPDATE users SET avatar_id = NULL) — manage_storage doesn't.


6. Quotas & error codes

LimitDefaultOverride
Per-file size10 MBstorage_config
Total app storagePlan-dependentUpgrade plan
Allowed content typesAll by defaultstorage_config.allowedContentTypes whitelist
ErrorWhen
QUOTA_FILE_SIZE_EXCEEDED (400)size_bytes > per-file limit
QUOTA_STORAGE_EXCEEDED (429)App total exhausted
VALIDATION_INVALID_TYPE (400)content_type not in whitelist
RESOURCE_NOT_FOUND (404)Object missing or caller unauthorized (deliberately ambiguous)
S3_ERROR (503)Transient S3 failure — retry

7. Common patterns

User avatar
  1. Upload form posts file → manage_storage (upload_url, public: false).
  2. Browser PUTs to upload_url.
  3. App calls UPDATE users SET avatar_id = $object_id.
  4. On profile render: manage_storage (download_url, object_id: user.avatar_id).
Public marketing image

Same flow, but public: true at upload time. Then the same download URL is reachable by anonymous visitors (no JWT needed) — useful for landing pages and OG images.

File attachment with auth

For attachments where access depends on app-level rules richer than "owner or public" (e.g. "members of this workspace can read"), don't expose the presigned URL directly. Wrap downloads in a serverless function:

ts
export async function handler(req, ctx) {
  const { rows } = await ctx.db.query(
    "SELECT object_id FROM attachments WHERE id = $1 AND workspace_id IN (SELECT workspace_id FROM members WHERE user_id = $2)",
    [attachmentId, ctx.user.id]
  );
  if (!rows.length) return new Response("forbidden", { status: 403 });
  const url = await getDownloadUrlServerSide(rows[0].object_id);
  return Response.redirect(url, 302);
}

The function runs as butterbase_user and uses your tables' RLS to authorize, then mints a presigned URL with the service key.


8. Anti-patterns

Don'tDo
Store the s3_key in your tablesStore the object_id UUID
Embed presigned URLs in HTML or DB rowsRe-fetch per render — they expire in 1 hour
Send the wrong Content-Type on PUTMatch exactly what you sent to upload_url
Call upload_url and forget step 3Always persist object_id after a successful PUT
Use public: true everywhere "just in case"Default to private; opt files into public explicitly
Delete a file without clearing FKsUpdate referencing rows first, then action: "delete"

If a docs/butterbase/00-state.md exists in the working directory, prefer invoking via /butterbase-skills:journey-storage so the journey orchestrator stays in sync.

© butterbase-ai, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/storage of butterbase-ai/butterbase-skills.

Open the folder on GitHubat commit aa8ae69

Compare with similar skills

Storage next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Storage compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Storage this skillbutterbase-ai/butterbase-skills534—~2.1kAutomated safety check: PassMIT
Stripe Projectsfossasia/eventyay1.7k5 repos~2kAutomated safety check: NotesApache-2.0
FoundatioFoundatioFx/Foundatio2.1k—~3.9kAutomated safety check: PassApache-2.0
Spatialduckdb/duckdb-skills6001 repos~1kAutomated safety check: NotesMIT
R Oopab604/claude-code-r-skills2062 repos~1.9kAutomated safety check: PassMIT
Edgestore Setupedgestorejs/edgestore454—~1.8kAutomated safety check: PassMIT

Similar skills

  • Stripe Projects

    fossasia/eventyay

    A skill your agent uses when the user wants to provision infrastructure or third-party services using Stripe Projects.

    1.7k GitHub starsUsed in 5 repos~2k tokens
    Backend & APIsAuto-check: notes
  • Foundatio

    FoundatioFx/Foundatio

    A skill your agent uses when working with Foundatio infrastructure abstractions for .NET -- caching, queuing, messaging, file storage, distributed locking, or background jobs.

    2.1k GitHub stars~3.9k tokensUpdated today
    Backend & APIsAuto-check passed
  • Spatial

    duckdb/duckdb-skills

    Official

    Answer questions about spatial data using DuckDB. An agent skill from duckdb/duckdb-skills.

    600 GitHub starsUsed in 1 repo~1k tokens
    Backend & APIsAuto-check: notes
  • R Oop

    ab604/claude-code-r-skills

    R object-oriented programming guide for S7, S3, S4, and vctrs.

    206 GitHub starsUsed in 2 repos~1.9k tokens
    Backend & APIsAuto-check passed
  • Edgestore Setup

    edgestorejs/edgestore

    A skill your agent uses when adding, extending, or troubleshooting EdgeStore file uploads, upload UI, or bucket access policies in a TypeScript/React application.

    454 GitHub stars~1.8k tokensUpdated 2 days ago
    Backend & APIsAuto-check passed
  • S3 Explore

    duckdb/duckdb-skills

    Official

    Explore and query data on S3, Cloudflare R2, GCS, MinIO, or any S3-compatible storage.

    600 GitHub starsUsed in 1 repo~848 tokens
    Backend & APIsAuto-check: notes

More from butterbase-ai/butterbase-skills

All 39 skills in this repo
  • AI

    butterbase-ai/butterbase-skills

    A skill your agent uses when calling the app's AI gateway from agent tools — chat completions, embeddings, listing models, configuring defaults or BYOK, reading token/cost usage

    534 GitHub stars~1.1k tokensUpdated 3 days ago
    Auto-check passed
  • Auth Setup

    butterbase-ai/butterbase-skills

    A skill your agent uses when configuring OAuth providers (Google/GitHub/Apple/X/etc.), setting up post-login auth hooks, tuning JWT lifetimes, or generating service API keys

    534 GitHub stars~2.2k tokensUpdated 3 days ago
    Auto-check passed
  • Build App

    butterbase-ai/butterbase-skills

    A skill your agent uses when building a new Butterbase app from scratch, creating a full-stack application, or when the user asks to set up a complete backend with database, auth, and deployment

    534 GitHub stars~4.9k tokensUpdated 3 days ago
    Auto-check passed
  • Contributing

    butterbase-ai/butterbase-skills

    A skill your agent uses when contributing to the Butterbase codebase, adding new MCP tools, creating API routes, writing migrations, or understanding the monorepo architecture

    534 GitHub stars~1.5k tokensUpdated 3 days ago
    Auto-check passed
  • Debug Rls

    butterbase-ai/butterbase-skills

    A skill your agent uses when users report access denied errors, see wrong data, RLS policies are not working, or when troubleshooting Row-Level Security issues in Butterbase

    534 GitHub stars~3.5k tokensUpdated 3 days ago
    Auto-check passed
  • Deploy Frontend

    butterbase-ai/butterbase-skills

    A skill your agent uses when deploying a frontend (React, Next.js, or static HTML) to a live URL on Butterbase, or when troubleshooting deployment issues like MIME type errors or blank pages

    534 GitHub stars~2.8k tokensUpdated 3 days ago
    Auto-check passed

Categories

Questions about Storage

What does Storage do?

A skill your agent uses when uploading or downloading files, generating presigned URLs, configuring storage ACLs, or persisting file references (avatars, attachments, images) in a Butterbase app. Storage is an agent skill from butterbase-ai/butterbase-skills.

When should I use Storage?

Storage fits situations like: downloading files; generating presigned URLs; configuring storage ACLs; persisting file references (avatars.

How do I install Storage in Claude Code?

Run `npx skills add butterbase-ai/butterbase-skills --skill storage -a claude-code`. Or copy the skill folder (skills/storage in butterbase-ai/butterbase-skills) into .claude/skills/storage in your project. Claude Code loads it when a task matches its description.

How do I install Storage in Codex?

Run `npx skills add butterbase-ai/butterbase-skills --skill storage -a codex`. Or copy the skill folder (skills/storage in butterbase-ai/butterbase-skills) into .agents/skills/storage in your project. Codex loads it when a task matches its description.

Can I use Storage in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add butterbase-ai/butterbase-skills --skill storage -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/storage, .gemini/skills/storage, .github/skills/storage and .opencode/skills/storage in your project.

What does Storage need to run?

Going by SKILL.md and its folder, Storage needs the command-line tools its instructions call (curl).

Does Storage access the network?

SKILL.md names 1 domain. In commands or code: s3.amazonaws.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is Storage safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Storage use?

Storage is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Storage use?

About 2.1k tokens (SKILL.md is roughly 8.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Storage?

Skills that share tags, products or a category with Storage: Stripe Projects (fossasia/eventyay, 1.7k stars), Foundatio (FoundatioFx/Foundatio, 2.1k stars), Spatial (duckdb/duckdb-skills, 600 stars) and R Oop (ab604/claude-code-r-skills, 206 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Storage?

butterbase-ai (a GitHub organization) maintains it in butterbase-ai/butterbase-skills, which has 534 GitHub stars. The repository holds 39 skills in this directory. The repository was last updated on October 5, 2026.

Source: butterbase-ai/butterbase-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.