Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add hmj1026/dhpk/plugin install dhpkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hmj1026/dhpk/migration-reviewer)<a href="https://agentmods.dev/agents/hmj1026/dhpk/migration-reviewer"><img src="https://agentmods.dev/badge/agents/hmj1026/dhpk/migration-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00113 | $0.02220 |
| Opus 5 | $0.00056 | $0.01110 |
| Sonnet 5 | $0.00023 | $0.00444 |
| Haiku 4.5 | $0.00011 | $0.00222 |
Grade A, and why
migration-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 158 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Migration Reviewer
Lookup:
cx/gitnexusper${CLAUDE_PLUGIN_ROOT}/rules/tool-routing.md. Domain DB context:database-reviewer(parent specialist for SQL correctness).
When NOT
- SQL correctness / bind parameters / IN-clauses →
database-reviewer. This agent covers up/down symmetry, idempotency, and online DDL.
Scope
Audits migration files only — typically **/migrations/**/*.{php,sql} (Yii / Laravel / Doctrine) or the project's equivalent path. SQL correctness (PDO bind / IN clause / index efficiency) is database-reviewer's territory; this agent looks at migration-specific risks:
- Up/down symmetry & reversibility
- Idempotency (re-run safety)
- FK / index naming collisions across multi-tenant deployments
- Large-ALTER online DDL safety on high-volume tables
- Engine / charset explicitness
- Transaction wrapping correctness for the engine in use
Diff scope
Sentinel-scoped precedence: see ${CLAUDE_PLUGIN_ROOT}/rules/execution-policy.md
"Sentinel-scoped precedence" — apply verbatim, sentinel = .pending-migration-review.
Back-stop fallback restricts to '**/migrations/**' (or the project's equivalent path).
Stack trap sheet (load on demand)
Detect the active stack, then load ONLY the matching trap sheet(s); ignore other stacks — never grade a Yii/SQL migration against Core Data rules, or vice-versa.
1-2. Loader: ${CLAUDE_PLUGIN_ROOT}/agent-traps/_common/trap-sheet-loader.md (<agent-name> = migration-reviewer). Manifest detection also covers *.xcdatamodeld.
3. No sheet matches → apply only the framework-agnostic Audit Checklist below.
The Audit Checklist below is the language-agnostic baseline; the loaded sheet adds stack-specific form, naming, and verification commands.
Audit Checklist
1. up/down symmetry (HARD)
- Every action in
uphas a matching reverse indown(addColumn↔dropColumn) - Drop column / FK / index in dependency order — drop the index / FK referencing a column before dropping the column itself
-
downexecutes SQL in reverse order ofup - Pure data migrations (
INSERT/UPDATE) either have a "restore to original"downpath or are clearly annotated// IRREVERSIBLE: <why>with follow-up plan
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed c7a2a5316c3a
- 6d ago First seen · 158 lines · 113 tokens per session scan A a71fb25c9e29
migration-reviewer is an agent published in the GitHub repository hmj1026/dhpk (2 stars, last pushed yesterday), licensed MIT. It adds 113 tokens to every session and 2,220 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
data-model-reviewer
A critical review agent for checking a database design before tables, migrations, or access rules are implemented.
dba
A read-only database expert for SQL Server, SQLite, and PostgreSQL, with guidance on table design, SQL differences, migrations, indexes, and query performance.
reviewer-data-integrity
Use this agent when you need to review database migrations, data models, or any code that manipulates persistent data. This includes checking migration safety, validating data constraints, ensuring transaction boundaries are correct, and verifying that referential integrity and privacy requirements are maintained.…
ccf-debugger
Investigates ONE assigned root-cause hypothesis/branch — follows the correlation ID across logs, queries the DB read-only to verify, returns evidence + judgment. Does NOT fix code. Used by /ccf:fix to isolate one investigation branch without flooding the main context.
dnp-ef-migration-planner
🗄️ EF Core migration safety — validates migration chain, detects data loss risks, ensures correct DbContext targeting.
analyst
A requirements-analysis agent for backend work. It turns customer messages, tickets, screenshots, or vague ideas into technical questions, assumptions, risks, and open questions.