sqlite-storage — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sqlite-storage (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Val Town provides built-in SQLite via the std/sqlite module. Reach for it whenever a val needs relational or structured persistent data. For simple key/value data, prefer std/blob instead.
import { sqlite } from "https://esm.town/v/std/sqlite/main.ts";
await sqlite.execute(`CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY,
name TEXT NOT NULL,
email TEXT UNIQUE
)`);
await sqlite.execute({
sql: "INSERT INTO users (name, email) VALUES (?, ?)",
args: ["Alice", "[email protected]"],
});
const result = await sqlite.execute("SELECT * FROM users");
// result.rows = [{ id: 1, name: "Alice", email: "[email protected]" }]Use sqlite.batch for atomic multi-statement transactions — all succeed or all roll back:
await sqlite.batch([
{ sql: "INSERT INTO users (name, email) VALUES (?, ?)", args: ["Bob", "[email protected]"] },
{ sql: "UPDATE users SET name = ? WHERE id = ?", args: ["Robert", 2] },
]);The import path determines which database you get. Both expose the same @libsql/client API (execute, batch) and return rows as keyed objects (Record<string, unknown>[]):
std/sqlite/main.ts — val-scoped database, isolated to this val. The default for new vals, and what you almost always want.std/sqlite/global.ts — organization-scoped database, shared across every val owned by the same account. (Your personal account counts as its own organization here, so this database is shared across all of your vals.)Do not switch an existing val between these import paths — it changes which database the val reads and writes.
When using the sqlite_execute or sqlite_batch tools to query a val owned by an organization (not your personal account), pass the org handle as the org parameter so the call hits the right database. Example: { sql: "SELECT * FROM users", org: "some-org" }. This only matters for the tool calls — code inside the val itself reads from its own database automatically.
args field) for any value derived from user input. Never interpolate strings into SQL.CREATE TABLE IF NOT EXISTS so schema setup is idempotent across val restarts.ALTER TABLE ... ADD COLUMN. Wrap in try/catch if the migration may run against an already-updated table.Full API docs: https://docs.val.town/reference/std/sqlite/usage/
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.