db-design

db-design is a skill for Claude Code, Codex from cass-2003/local-workflow-skill. It costs 76 tokens per session (2,960 once invoked), scanned A, original, MIT.

A database design and safety aid for creating tables, fields, indexes, queries, and migrations. It emphasizes checking existing structures, safe updates and deletes, required fields, and concurrency handling.

In plain words
What is it for?
Use it to review database schemas, add or remove fields safely, design indexes, write safer queries, and check database changes against application code.
Why use it?
It reduces accidental schema duplication, unsafe data changes, SQL injection risks, full-table updates, and race conditions when multiple requests access data.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to review database schemas, add or remove fields safely, design indexes, write safer queries, and check database changes against application code.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/cass-2003/local-workflow-skill/db-design
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add cass-2003/local-workflow-skill --skill db-design
Clone the repo
git clone --depth 1 https://github.com/cass-2003/local-workflow-skill

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for db-design

README.md
[![agentmods](https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/db-design/github.svg)](https://agentmods.dev/skills/cass-2003/local-workflow-skill/db-design)
Your own site
<a href="https://agentmods.dev/skills/cass-2003/local-workflow-skill/db-design"><img src="https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/db-design/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for db-design

Your own site · 80×15
<a href="https://agentmods.dev/skills/cass-2003/local-workflow-skill/db-design"><img src="https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/db-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 76 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,960 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00076 $0.02960
Opus 5 $0.00038 $0.01480
Sonnet 5 $0.00015 $0.00592
Haiku 4.5 $0.00008 $0.00296

Measured 6d ago against content hash 3881a5ad171c, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

db-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/data-analysis/codex/db-design/SKILL.md · 204 lines

How it starts

The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.

数据库工程师技能 (Database Engineer Skill)

快速规则(日常开发时自动加载,只需读到这里)

[DB核心清单] ① 新增前list_table+desc_table查重,字段必须有注释+默认值 ② 删除前Grep零引用+read_query确认数据可弃 ③ 每表必有id/created_at/updated_at [查询三禁]SELECT * ❌字符串拼接SQL ❌无WHERE的UPDATE/DELETE [并发铁律] 扣减用原子操作(WHERE count > 0),事务范围最小化,事务内禁调外部HTTP

涉及数据库操作时,强制遵守:

  1. 新增前查重list_table+desc_table确认表/字段不重复,新字段必须有注释+默认值+NOT NULL/NULL约束
  2. 删除前验证:Grep全项目确认字段零引用+read_query确认数据可丢弃,先代码停用→确认→再删字段
  3. 命名规范:表名snake_case复数(users),字段snake_case,布尔is_/has_前缀,时间_at后缀
  4. 查询安全:❌禁止SELECT *(新增字段意外暴露敏感数据) ❌禁止字符串拼接SQL(SQL注入可导出全库) ❌禁止无WHERE的UPDATE/DELETE(一次执行影响全表无法回滚)
  5. 并发安全:扣减用原子操作(WHERE count > 0),事务范围最小化,事务内禁止调外部HTTP(外部超时=长时间持锁阻塞全库)
  6. 索引原则:WHERE/JOIN/ORDER BY频繁字段建索引,复合索引遵守最左前缀,业务唯一字段加唯一索引
  7. 必备字段:每张表必须有id/created_at/updated_at,软删除用deleted_at

完整审查流程(手动 /db-design 或专项审查时执行)

Phase 1: 数据库现状扫描(必须用MCP工具)

强制使用MCP工具执行以下操作:

  1. list_table — 列出所有数据库表
  2. desc_table — 逐个检查每张表的结构(字段/类型/约束/注释)
  3. read_query — 检查数据量级、字段使用情况、索引使用率

扫描清单:

  • 所有表及其字段列表、类型、约束、注释
  • 表之间的外键/关联关系图
  • 每张表的数据量(行数估算)
  • 每个字段是否在代码中被引用(Grep项目代码确认)

Phase 2: 废弃字段与冗余检测

  1. 废弃字段检测(最关键——解决"创建了没用的字段"问题):

    • 用Grep搜索每个字段名在项目代码中的引用
    • 字段在代码中零引用 = 废弃字段,标记待清理
    • 字段只在旧版迁移中出现 = 遗留字段,评估是否可删
  2. 冗余检测

    • 相同含义不同命名的字段(如user_iduiduserId
    • 同一数据存储在多张表中(反范式是否有必要?)
    • 可计算字段(如total=price×quantity,是否需要物理存储?)
    • 未使用的表(零引用)
  3. 数据一致性检查

    • read_query检查:是否有NULL值在NOT NULL应为的字段
    • 外键关联的数据是否一致(孤儿记录)
    • 枚举字段是否有非法值

Phase 3: Schema设计审查

  1. 命名规范检查

    • 表名:小写+下划线(snake_case),复数形式(users不是user)
    • 字段名:小写+下划线,语义明确(created_at不是ct
    • 主键:统一id<table>_id
    • 外键:<关联表单数>_id(如user_id
    • 布尔字段:is_/has_前缀(is_active不是active
    • 时间字段:_at后缀(created_at/updated_at/deleted_at
    • ❌ 禁止:中文字段名、拼音缩写、无意义缩写(tp/st/flg
  2. 字段类型审查

    • 字符串:长度是否合理(名字VARCHAR(50)而非VARCHAR(255))
    • 数字:金额用DECIMAL不用FLOAT(浮点精度问题)
    • 时间:统一用DATETIME/TIMESTAMP,时区处理是否一致
    • 大文本:TEXT/BLOB是否应该拆到单独表
    • 枚举:ENUM vs TINYINT+注释,哪个更适合当前场景
    • JSON:是否滥用JSON字段(无法索引、无法约束)

Read the full file on GitHub · 204 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 204 lines · 76 tokens per session scan A 3881a5ad171c

Subscribe to this mod's changes

db-design is a skill published in the GitHub repository cass-2003/local-workflow-skill (12 stars, last pushed 2mo ago), licensed MIT. It adds 76 tokens to every session and 2,960 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

create-pr

Creates a GitHub PR with a Linear-ticket-prefixed title and a decision-led, narrative description for prisma-next. Use when the user wants to create a pull request, open a PR, or submit changes for review.

prisma/orm · 47 tokens

schema-exploration

Lists tables, describes columns and data types, identifies foreign key relationships, and maps entity relationships in a database. Use when the user asks about database schema, table structure, column types, what tables exist, ERD, foreign keys, or how entities relate.

langchain-ai/deepagents · 57 tokens

ha-data-stores

Map of Hope Agent's local data stores and safe read-only query workflow. Use when the user asks where Hope Agent stores data, wants to inspect sessions/messages/memory/logs/background jobs/knowledge indexes/settings, asks the model to query local app data, or debugging requires checking persisted state. Trigger…

shiwenwen/hope-agent · 115 tokens

supabase

Supabase / PostgREST Row-Level-Security playbook — pull the anon (or leaked servicerole) key out of the frontend JS, map tables from the auto-generated OpenAPI spec, test anonymous RLS READ disclosures (PII/secret leaks), and anonymous RLS WRITE abuse (insert/update/delete — e.g. forging…

PentesterFlow/agent · 120 tokens

nornicdb-cypher-queries

Pick fast, predictable Cypher query shapes in NornicDB — point lookups, batch retrieval, pagination, search, traversal, batched UNWIND/MERGE writes, cleanup, multi-tenant isolation. Use when writing or reviewing Cypher whose latency or throughput matters; maps user intent to the executor's hot-path query templates.

orneryd/NornicDB · 79 tokens

dsql

Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, diagnose cluster performance, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, foreign key…

awslabs/agent-plugins · 229 tokens