Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/ericrisco/rsc-harnessnpx agentmods add skills/ericrisco/rsc-harness/db-migrationsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ericrisco/rsc-harness/db-migrations)<a href="https://agentmods.dev/skills/ericrisco/rsc-harness/db-migrations"><img src="https://agentmods.dev/badge/skills/ericrisco/rsc-harness/db-migrations.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 220 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.03199 |
| Opus 5 | $0.00045 | $0.01599 |
| Sonnet 5 | $0.00018 | $0.00640 |
| Haiku 4.5 | $0.00009 | $0.00320 |
Grade A, and why
db-migrations scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 238 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Database migrations without downtime
A production migration is a sequence, not a statement. The moment you treat ALTER TABLE ... NOT NULL
as one atomic change, you have already lost: the lock blocks every writer, the deploy that depends on the
new column races the deploy that still reads the old one, and a rollback means a second outage. Your job
is to decompose one risky change into a chain of small steps where every intermediate state is
independently deployable — the old app keeps working, the new app keeps working, and you can stop at any
point without an outage.
This skill is engine-neutral. It owns the choreography — what order to run things in and how to keep each DDL from freezing the table — across Postgres, MySQL, and serverless variants, whatever runner you use (Flyway, Alembic, golang-migrate, drizzle-kit, raw SQL).
Route elsewhere
- Postgres lock internals, EXPLAIN/ANALYZE, indexing strategy, RLS, PgBouncer →
../postgresdb/SKILL.md. - Writing schema and running drizzle-kit specifically →
../drizzle-orm/SKILL.md. - PlanetScale deploy-request / branch cutover (Vitess online DDL) →
../planetscale/SKILL.md. - Creating/verifying backups, restore drills, PITR →
../backups/SKILL.md(a migration requires a backup; making it lives there). - Pure query logic — joins, windows, CTEs →
../sql/SKILL.md(backfill batching is here; query correctness is there).
Step 1 — Is this change online-safe in one step?
Most outages come from running a multi-step change as a single statement. Decide first:
| Change | One step? | Why |
|---|---|---|
| Add nullable column, no volatile default | Yes | Metadata-only on PG 11+/modern MySQL; no rewrite, no long lock. |
| Add column with a constant default | Yes (PG 11+) | Stored as a catalog default, no table rewrite. |
| Add column with a volatile/expression default | No | Rewrites every row under lock → expand-contract. |
Add NOT NULL to existing/new column |
No | Full-table validation scan under lock → add-nullable → backfill → validate. |
| Rename column / table | No | App reads the old name; needs dual-name window → expand-contract. |
| Change column type (non-trivial) | No | Rewrites rows, may invalidate the running app → new column + backfill. |
| Split / merge columns | No | Two-sided data move → expand-contract. |
| Drop column / table | No | Running app may still reference it → contract only after a cooling period. |
| Add foreign key | No | ADD CONSTRAINT validates all rows under lock → add NOT VALID then VALIDATE. |
| Create index | No, but cheap | Plain CREATE INDEX locks writes → use CONCURRENTLY. |
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 238 lines · 90 tokens per session scan A 40ab0bfe53f1
db-migrations is a skill published in the GitHub repository ericrisco/rsc-harness (70 stars, last pushed today), licensed MIT. It adds 90 tokens to every session and 3,199 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
database-migration-patterns
Manage database schema changes safely with migration tools, zero-downtime strategies, and rollback procedures. Covers Alembic, SQL migrations, data migrations, and testing strategies. Triggers on database migration, schema changes, or Alembic configuration requests.
traverse-multi-hop
Expresses a multi-hop lineage question as a single variable-length path match against native graph storage, bounded by an explicit hop depth and an explicit relationship-type allowlist, instead of a recursive relational join that grows one level per hop.
query-graph
Loads schema.sql into a local SQLite file, then answers availability and provenance questions against the nodes/edges tables with real SQL instead of re-reading source material.
score-and-merge
Scores candidate merge pairs on weighted signals and auto-merges only pairs clearing a stated threshold, routing the rest to a review queue with their score and signal breakdown attached.
transact-graph-write
Wraps every write to a shared graph edge in a transaction tied to the exact row version it was computed against, and retries a rejected write against the row's current state instead of dropping it or blindly reapplying stale values.
attach-receipts
Attaches sourcedoc/extractionrunid/schemaversion receipts to every edge at write time, and refuses to write any edge missing one of the three.