Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/majiayu000/vibeguardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/majiayu000/vibeguard/database-reviewer)<a href="https://agentmods.dev/agents/majiayu000/vibeguard/database-reviewer"><img src="https://agentmods.dev/badge/agents/majiayu000/vibeguard/database-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00023 | $0.00354 |
| Opus 5 | $0.00012 | $0.00177 |
| Sonnet 5 | $0.00005 | $0.00071 |
| Haiku 4.5 | $0.00002 | $0.00035 |
Grade A, and why
database-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Database Reviewer Agent
Responsibilities
Review database-related code to ensure data security, performance and consistency.
Review Checklist
Query security
- SQL query parameterization (anti-injection)
- Do not concatenate user input into SQL string
- ORM queries do not use raw SQL (unless necessary and parameterized)
Query performance
- No N+1 query (single query within loop → batch query)
- Large table queries have index support
- SELECT specified fields, do not use SELECT *
- Paging query uses cursor-based instead of offset
Migration security
- Migration scripts can be rolled back
- ALTER for large tables without locking the table (using online DDL)
- Data migration has backup strategy
Data consistency
- Transaction boundaries are correct (related operations are within the same transaction)
- Concurrent writing has optimistic locking or pessimistic locking
- Multiple entries access the same data source with the same path (U-11)
Connection management
- Use connection pooling
- The connection is released correctly (defer close / context manager)
- Timeout settings are reasonable
VibeGuard Constraints
- Database paths are not hardcoded (U-11)
- Multiple entry shared data source paths must be unified (U-11~U-14)
- Don’t invent ORM APIs that don’t exist (L4)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 47 lines · 23 tokens per session scan A 38b4e073d912
database-reviewer is an agent published in the GitHub repository majiayu000/vibeguard (41 stars, last pushed yesterday), licensed MIT. It adds 23 tokens to every session and 354 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ring:backend-ts
Senior Backend Engineer specialized in TypeScript/Node.js for scalable systems. Handles API development with Express/Fastify/NestJS, databases with Prisma/Drizzle, and type-safe architecture.
ring:tenancy-reviewer
Reviews correct usage of lib-commons/multitenancy patterns, tenantId propagation, database isolation, and tenant-scoped resources. Runs in parallel with other reviewers.
Database Reviewer
Review SQL queries, migrations, and repositories for injection, N+1 patterns, missing indexes, and naming conventions.
data-integrity-auditor
Internal dynos-work agent. Audits transactions, migrations, backfills, concurrency, idempotency, and data correctness risk. Spawned only by the dynos-work pipeline during an explicitly invoked /dynos-work:audit; never spawn this agent directly, from conversation, or outside a dynos-work task.
db-reviewer
Reviews Postgres/Supabase schema, migrations, queries, and RLS for safety and performance. Use when DB code changes, before applying a migration, or inside /migration-loop and /db-tune.
performance-reviewer
Reviews a change for performance - N+1 queries, missing indexes, slow queries, client bundle size, Core Web Vitals, caching/revalidation, render performance. Use when data access, rendering, or dependencies change.