Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cosmix/loom --skill loom-sql-optimizationgit clone --depth 1 https://github.com/cosmix/loomWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cosmix/loom/loom-sql-optimization)<a href="https://agentmods.dev/skills/cosmix/loom/loom-sql-optimization"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-sql-optimization/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cosmix/loom/loom-sql-optimization"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-sql-optimization.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 515 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.07008 |
| Opus 5.5 | $0.00006 | $0.02803 |
| Sonnet 5.5 | $0.00003 | $0.01402 |
| Haiku 4.5 | $0.00002 | $0.00701 |
Grade A, and why
loom-sql-optimization scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 545 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SQL Optimization
Overview
Analyzing and tuning SQL for performance: reading execution plans, index design, query rewriting, and PostgreSQL-specific behavior. Most notes assume PostgreSQL. The mechanism-level material — reading EXPLAIN, composite-index column order, partial-index limits, statistics, concurrency — is in Expert Practices below; this section is the workflow and the anti-pattern catalogue.
Workflow
- Find the slow query (logs,
pg_stat_statementsby total time, not just per-call). - Explain it:
EXPLAIN (ANALYZE, BUFFERS, SETTINGS). Read plans by estimated-vs-actual row divergence (bad stats → wrong join/scan choice), scan type, join algorithm, andRows Removed by Filter. See Expert Practices → Reading EXPLAIN. - Fix in priority order: refresh/extend statistics → add/reshape an index → rewrite the query → denormalize/derive → tune config. Change one thing at a time.
- Validate: re-EXPLAIN on production-like data, confirm the target node changed (Sort gone / Index Scan chosen / Heap Fetches low), verify correctness, monitor post-deploy.
Best Practices
EXPLAIN (ANALYZE, BUFFERS)is the source of truth — never optimize by guessing; actual rows and buffers reveal the real cost.- Select only needed columns (enables index-only scans; avoids TOAST/wide-row I/O).
- Index for WHERE/JOIN/ORDER BY, but mind column order and the write tax (Expert Practices → Index Design).
- Avoid N+1: one JOIN or a batched
WHERE id = ANY($1), not a query per row. NOT EXISTS, neverNOT IN (nullable subquery)— one NULL silently returns zero rows;NOT EXISTSis NULL-safe and hash-anti-join-able. (InclusionIN/ANY/EXISTSplan identically in modern PG — pick readability.)- No functions/implicit casts on indexed columns (
WHERE lower(x)=needs an expression index;WHERE int_col = '1'may cast and skip the index). - Keyset pagination, not deep
OFFSET(Expert Practices). - CTEs are not fences (PG12+): a non-recursive, side-effect-free CTE used once is inlined; used >1× it materializes. Force with
AS MATERIALIZED/AS NOT MATERIALIZED; theOFFSET 0trick is obsolete. ANALYZEafter bulk loads; monitor query performance over time.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 545 lines · 16 tokens per session scan A 83142f745312
loom-sql-optimization is a skill published in the GitHub repository cosmix/loom (62 stars, last pushed 2d ago), licensed MIT. It adds 16 tokens to every session and 7,008 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
aws-rds-spring-boot-integration
Provides patterns to configure AWS RDS (Aurora, MySQL, PostgreSQL) with Spring Boot applications. Configures HikariCP connection pools, implements read/write splitting, sets up IAM database authentication, enables SSL connections, and integrates with AWS Secrets Manager. Use when setting up RDS connections in Spring…
postgresql-review
PostgreSQL query review, optimalisering og beste praksis for Nav-applikasjoner.
domainmodel-dsl
Read, write, and modify Domain Model DSL files (.dmodel) — datatypes, entities with inheritance and multi-valued features, and nested packages with qualified cross-references. Use when the user wants to create, edit, explain, or debug a domain model in this DSL, including resolving references across packages.
domainmodel-dsl
Work with the Domain Model DSL (.dmodel) for describing data models — datatypes, entities, and their features. Use when the user wants to create or edit a domain model in this DSL.
timescaledb
MANDATORY when working with time-series data, hypertables, continuous aggregates, or compression - enforces TimescaleDB 2.24.0 best practices including lightning-fast recompression, UUIDv7 continuous aggregates, and Direct Compress.
database-architecture
MANDATORY when designing schemas, writing migrations, creating indexes, or making architectural database decisions - enforces PostgreSQL 18 best practices including AIO, UUIDv7, temporal constraints, and modern indexing strategies.