db-schema-reviewer

db-schema-reviewer is an agent for Claude Code from cubha/claude-workflow-plugins. It costs 74 tokens per session (998 once invoked), scanned A, original, MIT.

A database schema and migration reviewer examines changes to the structure of a database, such as tables, columns, indexes, and data updates. It reviews only the files provided and produces a report without changing code.

In plain words
What is it for?
Use it when reviewing SQL, schema, or migration files for safety, performance, constraints, naming, and rollback risks.
Why use it?
It helps catch data-loss risks, service outages, missing indexes, inconsistent types, and unsafe changes before they reach production.

Agent for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: model in frontmatter.

Part of the ship plugin — 1 skill, 2 agents shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/cubha/claude-workflow-plugins/db-schema-reviewer
Clone the repo
git clone --depth 1 https://github.com/cubha/claude-workflow-plugins

Made for: Claude Code.

Or install ship, the plugin that ships this one along with the rest of its 1 skill, 2 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for db-schema-reviewer

README.md
[![agentmods](https://agentmods.dev/badge/agents/cubha/claude-workflow-plugins/db-schema-reviewer.svg)](https://agentmods.dev/agents/cubha/claude-workflow-plugins/db-schema-reviewer)
Your own site
<a href="https://agentmods.dev/agents/cubha/claude-workflow-plugins/db-schema-reviewer"><img src="https://agentmods.dev/badge/agents/cubha/claude-workflow-plugins/db-schema-reviewer.svg" alt="Measured on agentmods" height="20"></a>
Per session 74 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 998 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00074 $0.00998
Opus 5 $0.00037 $0.00499
Sonnet 5 $0.00015 $0.00200
Haiku 4.5 $0.00007 $0.00100

Measured 5d ago against content hash e26ab720e1e7, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

db-schema-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/ship/agents/db-schema-reviewer.md · 96 lines

What it actually says

역할: DB 스키마·마이그레이션 검토 전문가

너는 데이터베이스 스키마 변경과 마이그레이션 파일을 검토하는 전문가다.

핵심 원칙

  • 코드 수정 금지 — 검토·보고만 수행한다
  • 전달된 파일만 분석 — 전체 프로젝트 스캔 금지 (토큰 낭비 방지)
  • 운영 안전성 최우선 — 기존 데이터 손실·서비스 중단 위험 패턴에 집중
  • 실행 가능한 권고 — 구체적인 수정 방향 제시

트리거 파일 패턴

다음 패턴에 해당하는 파일이 변경된 경우에만 호출된다:

*.sql
*migration*
*schema.ts | *schema.js | *schema.prisma
*drizzle* | *prisma/migrations/*
supabase/migrations/*

검토 카테고리

코드 카테고리 예시
D1 마이그레이션 안전성 NOT NULL 컬럼 추가 (기존 데이터 없음), DROP TABLE/COLUMN
D2 인덱스 설계 FK 인덱스 누락, 자주 쿼리되는 컬럼 인덱스 누락
D3 타입·제약 설계 부적절한 타입(TEXT vs VARCHAR), 길이 제한 누락
D4 롤백 가능성 비가역 마이그레이션 (데이터 손실 위험)
D5 명명 규칙 테이블/컬럼 네이밍 컨벤션 불일치
D6 성능 위험 대용량 테이블 구조 변경, 락 발생 가능성

작업 흐름

1. 파일 로드

전달받은 파일 목록의 스키마/마이그레이션 파일을 읽는다.

2. 컨텍스트 파악 (경량)

# 기존 스키마 파악 (마이그레이션인 경우)
ls supabase/migrations/ 2>/dev/null | tail -5
ls prisma/migrations/ 2>/dev/null | tail -5

3. 검토 수행

변경 내용의 각 카테고리를 분석한다.

4. 보고서 작성

🗄️ DB 스키마 검토 결과
──────────────────────────────────────
검토 파일: N개 | 발견 이슈: X건
──────────────────────────────────────

🔴 Critical (A건)
  1. [D1] supabase/migrations/20260527_add_users.sql:12
     → users.email에 NOT NULL 추가 — 기존 NULL 레코드 마이그레이션 실패 위험
     → 권장: DEFAULT '' 또는 2단계 마이그레이션 (nullable 추가 → 데이터 채움 → NOT NULL 변경)

  2. [D4] 20260527_refactor.sql:5
     → DROP COLUMN user_data — 비가역 작업, 백업 없이 실행 시 데이터 손실
     → 권장: 마이그레이션 전 pg_dump 또는 soft delete 패턴 고려

🟡 Warning (B건)
  1. [D2] schema.ts:34
     → orders.user_id FK에 인덱스 없음 — 사용자별 주문 조회 시 풀스캔 위험
     → 권장: CREATE INDEX idx_orders_user_id ON orders(user_id)

ℹ️ Info (C건)
  1. [D5] 20260527_add_logs.sql
     → 컬럼명 createdAt (camelCase) — 프로젝트 컨벤션과 불일치 (snake_case 사용 중)
     → 권장: created_at으로 통일
──────────────────────────────────────
✅ 이상 없음 | ⚠️ Critical 발견 시 마이그레이션 실행 전 수정 권장

호출처별 동작

호출처 모드
ship Step 1 QUICK — Critical/Warning만 보고
직접 호출 DEEP — 변경된 모든 스키마 파일 상세 검토
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 96 lines · 74 tokens per session scan A e26ab720e1e7

Subscribe to this mod's changes

db-schema-reviewer is an agent published in the GitHub repository cubha/claude-workflow-plugins (2 stars, last pushed 1mo ago), licensed MIT. It adds 74 tokens to every session and 998 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other agents, from other repositories

data-model-architect

Use when an orchestrator needs a Dataverse data model proposed (existing-table reuse, new tables in dependency-tier order, Mermaid ER diagram) for embedding in native-app-plan.md. Read-only — proposes, never mutates. Called by native-app-planner and /edit-app; not invoked directly by users.

microsoft/power-platform-skills · 67 tokens

genpage-entity-builder

Creates Dataverse entities (tables, columns, relationships, choices) specified in genpage-plan.md using the plugin's Node.js Web API scripts. Handles dependency ordering, propagation delays, sample data creation (with $batch bulk), and solution membership. Called by the genpage skill when new entities need creating …

microsoft/power-platform-skills · 73 tokens

ecto-schema-designer

Ecto schema architect - designs migrations, data models, and query patterns. Use proactively when planning database structure for new features.

oliver-kriska/claude-elixir-phoenix · 30 tokens

ash-query-optimizer

Ash query optimizer — detects N+1 loads, suggests aggregates over load+Enum, identifies calculation vs load tradeoffs. Use when reviewing Ash queries, LiveView data loading, or domain action efficiency.

oliver-kriska/claude-elixir-phoenix · 45 tokens

db-migration-reviewer

Database migration safety specialist. Activates when migrations/ files are detected in a PR or feature branch. Checks lock duration, rollback strategy, zero-downtime patterns, PII column handling, and index creation safety. Writes docs/migrations/MIGRATE-{slug}.md. Blocks deploy if no rollback path exists.

avelikiy/great_cto · 69 tokens

infra-provisioner

Provisions the real backing infrastructure for a Product-Builder product so it reaches a live URL — managed Postgres (Neon default), the hosting project (Vercel default), env/secret wiring, and the custom domain + DNS + TLS. Pairs with devops (which does preview/staging only and refuses prod/real-domain). Runs after…

avelikiy/great_cto · 137 tokens