Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/caiaffa/claude-code-ultimate-engineering-system/postgres-performance-and-safetynpx skills add caiaffa/claude-code-ultimate-engineering-system --skill postgres-performance-and-safetygit clone --depth 1 https://github.com/caiaffa/claude-code-ultimate-engineering-systemWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/caiaffa/claude-code-ultimate-engineering-system/postgres-performance-and-safety)<a href="https://agentmods.dev/skills/caiaffa/claude-code-ultimate-engineering-system/postgres-performance-and-safety"><img src="https://agentmods.dev/badge/skills/caiaffa/claude-code-ultimate-engineering-system/postgres-performance-and-safety.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00030 | $0.00520 |
| Opus 5 | $0.00015 | $0.00260 |
| Sonnet 5 | $0.00006 | $0.00104 |
| Haiku 4.5 | $0.00003 | $0.00052 |
Grade A, and why
postgres-performance-and-safety scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 52 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mission
Protect data correctness while enabling sustainable performance and safe evolution of relational workloads.
When to use
- Reviewing queries and transactions.
- Planning schema migrations.
- Diagnosing lock contention or slow queries.
- Evaluating data consistency guarantees.
Handoff
- Receives from: backend-platform-engineer (implementation).
- Hands off to: release-commander (for migration rollout), otel-observability-architect (query telemetry).
Before answering
Identify: consistency requirements, read/write ratio, transaction boundaries, migration window tolerance, table growth pattern, indexing maturity.
Migration safety rules
| Operation | Risk | Safe approach |
|---|---|---|
| Add column with default | Rewrites table in PG < 11 | Use ALTER TABLE ... ADD COLUMN ... DEFAULT x (PG 11+ is safe) |
| Add NOT NULL | Locks table for validation | Add column nullable → backfill → add constraint with NOT VALID → validate |
| Add index | Locks writes | CREATE INDEX CONCURRENTLY |
| Rename column | Breaks queries | Add new column → dual-write → migrate reads → drop old |
| Drop column | Irreversible | Stop reading first → deploy → drop in next release |
| Change column type | Locks + rewrites | Add new column → backfill → swap |
Transaction anti-patterns
- Long transactions holding locks while calling external APIs.
SELECT ... FOR UPDATEon hot rows without timeout.- Application-level retry that creates duplicate inserts without dedup.
- Missing
WHEREclause onUPDATEorDELETE(no safety net).
Query review checklist
- Does the query have an efficient execution plan? (
EXPLAIN ANALYZE) - Are joins correct in cardinality? (1:1, 1:N, N:M)
- Is pagination stable under concurrent writes? (cursor > offset)
- Are there missing indexes on filter/join columns?
- Is the transaction scope as narrow as possible?
- Are there lock contention risks?
Output format
- Data access assessment
- Correctness risks (with severity)
- Performance risks (with evidence)
- Migration plan (safe step-by-step)
- Monitoring (query latency, lock waits, index usage)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 52 lines · 30 tokens per session scan A e971dd996bec
postgres-performance-and-safety is a skill published in the GitHub repository caiaffa/claude-code-ultimate-engineering-system (17 stars, last pushed 2mo ago), licensed MIT. It adds 30 tokens to every session and 520 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
safe-sql-execution
Use whenever code will build, return, fetch, or execute SQL that runs against a user's real Postgres database — even when the request reads like an ordinary feature or bug fix and never says "security," "injection," or "SafeSqlFragment." This covers: writing or editing any pg-meta function, query builder, or endpoint…
payload-cms
Install and wire Payload CMS into this Next.js 16 app, backed by Supabase Postgres and Supabase Storage — packages, payload.config.ts, the (payload) route group, collections derived from the actual page views, type generation, migrations, and proving the read loop end-to-end. Use when the user asks to "add a CMS"…
dump-schema
Dump clean Postgres schema to a file and copy path to clipboard.
neon-postgres
Guides and best practices for working with Neon Serverless Postgres. Covers getting started, local development with Neon, choosing a connection method, Neon features, authentication (@neondatabase/auth), PostgREST-style data API (@neondatabase/neon-js), Neon CLI, and Neon's Platform API/SDKs. Use for any Neon-related…
postgres
Configure DigitalOcean Managed Postgres with bindable variables or schema isolation. Use when setting up databases, creating users, managing permissions, configuring multi-tenant schemas, or troubleshooting database connectivity on App Platform.
managing-databases
Guides database architecture for PostgreSQL, DuckDB, Parquet, PGVector, and Neo4j. Use when designing schemas, choosing storage strategies, optimizing queries, configuring vector or graph workloads, or diagnosing performance issues.