Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cass-2003/local-workflow-skill --skill db-designgit clone --depth 1 https://github.com/cass-2003/local-workflow-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cass-2003/local-workflow-skill/db-design)<a href="https://agentmods.dev/skills/cass-2003/local-workflow-skill/db-design"><img src="https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/db-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cass-2003/local-workflow-skill/db-design"><img src="https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/db-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.02960 |
| Opus 5 | $0.00038 | $0.01480 |
| Sonnet 5 | $0.00015 | $0.00592 |
| Haiku 4.5 | $0.00008 | $0.00296 |
Grade A, and why
db-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
数据库工程师技能 (Database Engineer Skill)
快速规则(日常开发时自动加载,只需读到这里)
[DB核心清单] ① 新增前
list_table+desc_table查重,字段必须有注释+默认值 ② 删除前Grep零引用+read_query确认数据可弃 ③ 每表必有id/created_at/updated_at[查询三禁] ❌SELECT *❌字符串拼接SQL ❌无WHERE的UPDATE/DELETE [并发铁律] 扣减用原子操作(WHERE count > 0),事务范围最小化,事务内禁调外部HTTP
涉及数据库操作时,强制遵守:
- 新增前查重:
list_table+desc_table确认表/字段不重复,新字段必须有注释+默认值+NOT NULL/NULL约束 - 删除前验证:Grep全项目确认字段零引用+
read_query确认数据可丢弃,先代码停用→确认→再删字段 - 命名规范:表名snake_case复数(
users),字段snake_case,布尔is_/has_前缀,时间_at后缀 - 查询安全:❌禁止
SELECT *(新增字段意外暴露敏感数据) ❌禁止字符串拼接SQL(SQL注入可导出全库) ❌禁止无WHERE的UPDATE/DELETE(一次执行影响全表无法回滚) - 并发安全:扣减用原子操作(
WHERE count > 0),事务范围最小化,事务内禁止调外部HTTP(外部超时=长时间持锁阻塞全库) - 索引原则:WHERE/JOIN/ORDER BY频繁字段建索引,复合索引遵守最左前缀,业务唯一字段加唯一索引
- 必备字段:每张表必须有
id/created_at/updated_at,软删除用deleted_at
完整审查流程(手动 /db-design 或专项审查时执行)
Phase 1: 数据库现状扫描(必须用MCP工具)
强制使用MCP工具执行以下操作:
list_table— 列出所有数据库表desc_table— 逐个检查每张表的结构(字段/类型/约束/注释)read_query— 检查数据量级、字段使用情况、索引使用率
扫描清单:
- 所有表及其字段列表、类型、约束、注释
- 表之间的外键/关联关系图
- 每张表的数据量(行数估算)
- 每个字段是否在代码中被引用(Grep项目代码确认)
Phase 2: 废弃字段与冗余检测
-
废弃字段检测(最关键——解决"创建了没用的字段"问题):
- 用Grep搜索每个字段名在项目代码中的引用
- 字段在代码中零引用 = 废弃字段,标记待清理
- 字段只在旧版迁移中出现 = 遗留字段,评估是否可删
-
冗余检测:
- 相同含义不同命名的字段(如
user_id和uid和userId) - 同一数据存储在多张表中(反范式是否有必要?)
- 可计算字段(如
total=price×quantity,是否需要物理存储?) - 未使用的表(零引用)
- 相同含义不同命名的字段(如
-
数据一致性检查:
read_query检查:是否有NULL值在NOT NULL应为的字段- 外键关联的数据是否一致(孤儿记录)
- 枚举字段是否有非法值
Phase 3: Schema设计审查
-
命名规范检查:
- 表名:小写+下划线(snake_case),复数形式(
users不是user) - 字段名:小写+下划线,语义明确(
created_at不是ct) - 主键:统一
id或<table>_id - 外键:
<关联表单数>_id(如user_id) - 布尔字段:
is_/has_前缀(is_active不是active) - 时间字段:
_at后缀(created_at/updated_at/deleted_at) - ❌ 禁止:中文字段名、拼音缩写、无意义缩写(
tp/st/flg)
- 表名:小写+下划线(snake_case),复数形式(
-
字段类型审查:
- 字符串:长度是否合理(名字VARCHAR(50)而非VARCHAR(255))
- 数字:金额用DECIMAL不用FLOAT(浮点精度问题)
- 时间:统一用DATETIME/TIMESTAMP,时区处理是否一致
- 大文本:TEXT/BLOB是否应该拆到单独表
- 枚举:ENUM vs TINYINT+注释,哪个更适合当前场景
- JSON:是否滥用JSON字段(无法索引、无法约束)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 204 lines · 76 tokens per session scan A 3881a5ad171c
db-design is a skill published in the GitHub repository cass-2003/local-workflow-skill (12 stars, last pushed 2mo ago), licensed MIT. It adds 76 tokens to every session and 2,960 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
create-pr
Creates a GitHub PR with a Linear-ticket-prefixed title and a decision-led, narrative description for prisma-next. Use when the user wants to create a pull request, open a PR, or submit changes for review.
schema-exploration
Lists tables, describes columns and data types, identifies foreign key relationships, and maps entity relationships in a database. Use when the user asks about database schema, table structure, column types, what tables exist, ERD, foreign keys, or how entities relate.
ha-data-stores
Map of Hope Agent's local data stores and safe read-only query workflow. Use when the user asks where Hope Agent stores data, wants to inspect sessions/messages/memory/logs/background jobs/knowledge indexes/settings, asks the model to query local app data, or debugging requires checking persisted state. Trigger…
supabase
Supabase / PostgREST Row-Level-Security playbook — pull the anon (or leaked servicerole) key out of the frontend JS, map tables from the auto-generated OpenAPI spec, test anonymous RLS READ disclosures (PII/secret leaks), and anonymous RLS WRITE abuse (insert/update/delete — e.g. forging…
nornicdb-cypher-queries
Pick fast, predictable Cypher query shapes in NornicDB — point lookups, batch retrieval, pagination, search, traversal, batched UNWIND/MERGE writes, cleanup, multi-tenant isolation. Use when writing or reviewing Cypher whose latency or throughput matters; maps user intent to the executor's hot-path query templates.
dsql
Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, diagnose cluster performance, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, foreign key…