What is find-postgres-bug?

A guide for finding hidden bugs in a local PostgreSQL source tree. PostgreSQL is an open-source database system, and a source tree is its checked-out code.

Building a debug PostgreSQL instance, fuzzing it with SQLsmith, analysing crashes, creating minimal reproductions, and tracking down the responsible code change.

It uses intensive testing and crash investigation to uncover failures that ordinary tests may miss and reduce them to a reproducible example.

find-postgres-bug — Skill by digoal

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/digoal/blog/find-postgres-bug

Any agent

npx skills add digoal/blog --skill find-postgres-bug

Clone the repo

git clone --depth 1 https://github.com/digoal/blog

Made for: Claude Code, Codex.

Per session 195 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 4,246 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin unknown No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00195	$0.04246
Opus 5	$0.00097	$0.02123
Sonnet 5	$0.00039	$0.00849
Haiku 4.5	$0.00019	$0.00425

Measured 3d ago against content hash 08d091f6e405, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

find-postgres-bug scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

The scan reads SKILL.md. This mod also ships 12 executable files (scripts/analyze_commit.sh, scripts/bisect_run.sh, scripts/build_and_start_pg.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/find-postgres-bug/SKILL.md · 391 lines

The source is not reproduced here

Licensed GPL-2.0

The repository is licensed GPL-2.0, which this catalogue does not treat as permission to reproduce the file. Read it at the source.

Read it on GitHub

Files

What ships with it

23 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 391 lines · 195 tokens per session scan A 08d091f6e405

Subscribe to this mod's changes

find-postgres-bug is a skill published in the GitHub repository digoal/blog (8,569 stars, last pushed yesterday), licensed GPL-2.0. It adds 195 tokens to every session and 4,246 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Databases Debugging PostgreSQL enterprisedb gpdb greenplum hawq postgresql

safe-sql-execution

Use whenever code will build, return, fetch, or execute SQL that runs against a user's real Postgres database — even when the request reads like an ordinary feature or bug fix and never says "security," "injection," or "SafeSqlFragment." This covers: writing or editing any pg-meta function, query builder, or endpoint…

supabase/supabase · 221 tokens

write-script-postgresql

MUST use when writing PostgreSQL queries.

windmill-labs/windmill · 14 tokens

diesel-guard

Lints Diesel and SQLx Postgres migrations for unsafe schema changes that lock tables or cause downtime, and authors custom Rhai checks. Use when reviewing, writing, or fixing SQL migrations, when diesel-guard reports a violation, when configuring diesel-guard.toml, or when the user mentions migration safety, table…

ayarotsky/diesel-guard · 77 tokens

database

Relational database authority — PostgreSQL, async ORM (SQLAlchemy 2 / asyncpg), Alembic schema migrations, Supabase Python and JS clients, query optimisation, index strategy, connection pooling, transaction patterns, and bulk operations across Python and Node stacks.

LuuOW/meridian-mcp · 54 tokens

postgres-sql-fundamentals

Postgres fundamentals for when you outgrow SQLite — psql, schema design, constraints, indexes, transactions, EXPLAIN, and connection pooling.

vikasudasi/skill-vault · 38 tokens

PostgreSQL

PostgreSQL 17.x — data types, DDL, DML, queries, indexes, full text search, concurrency, performance, functions.

pledgeandgrow/pledge-skills · 34 tokens