Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Hainrixz/claude-db --skill checklistgit clone --depth 1 https://github.com/Hainrixz/claude-dbWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hainrixz/claude-db/checklist)<a href="https://agentmods.dev/skills/hainrixz/claude-db/checklist"><img src="https://agentmods.dev/badge/skills/hainrixz/claude-db/checklist.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00147 | $0.00897 |
| Opus 5 | $0.00073 | $0.00449 |
| Sonnet 5 | $0.00029 | $0.00179 |
| Haiku 4.5 | $0.00015 | $0.00090 |
Grade A, and why
checklist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 36 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/claude-db:checklist
A production-readiness GO/NO-GO grid. Read-only — runs an audit and maps the findings onto a fixed launch checklist; never writes files or mutates the database.
$ARGUMENTS = <path|connection-target> [flags]. The target is a repo path (schema/ORM/migration files) and, optionally, a live database via $DATABASE_URL for Tier-1/2 verification. If no target is given and no artifacts are found, say so and suggest /claude-db:start or /claude-db:design.
What to do
-
Invoke the db-orchestrator skill with the target and
--tierflag to run the read-only audit (stack detection → schema parse → auditor subagents → merged findings → scores). Reuse an existingfindings.jsonif the user passes one. -
Map the merged findings onto the fixed checklist below. Each row gets a status — PASS (satisfied), WARN (non-blocking gap), FAIL (blocking gap), or NEEDS-LIVE (cannot be confirmed without a live connection / higher tier) — plus the finding id(s) that drive it.
Check What it verifies PITR / backups Point-in-time recovery or backup policy is configured — NEEDS-LIVE by default 1 RLS on tenant tables Row-level security enforced on multi-tenant tables FK indexes Every foreign key column is covered by an index Money as numeric Monetary columns use numeric/decimal, never floattimestamptz / UTC Timestamps are timezone-aware and stored in UTC Connection pooling sized Pool is configured and sized for the platform's limits Migration reversibility Migrations have working down/rollback paths Secrets not in schema No credentials/secrets embedded in schema or DDL charset / utf8mb4 MySQL uses utf8mb4(full Unicode), correct collation
Footnotes
-
No static module audits backups/DR/PITR, so this row is rendered NEEDS-LIVE by default — it can only be confirmed at Tier-1 (a live connection / provider config) and offline is reported as
needs_api, never assumed present (never a silent PASS). ↩
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 36 lines · 147 tokens per session scan A ea5e4a2d3320
checklist is a skill published in the GitHub repository Hainrixz/claude-db (19 stars, last pushed 2mo ago), licensed MIT. It adds 147 tokens to every session and 897 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dynamodb
Use when modeling or operating a DynamoDB table: deriving partition/sort keys from access patterns, single-table vs table-per-entity, adding a GSI/LSI, on-demand vs provisioned capacity, or diagnosing hot-partition throttling. NOT relational schema/SQL/EXPLAIN (that is postgresdb), NOT aggregation-pipeline document…
malloy-lookml-review
Analyze LookML files as prior art for Malloy modeling. Used during Step 1 (DISCOVER) when .lkml files are present. Coordinates reference files that extract business logic, relationships, and curation decisions. Works with or without a database connection.
convex-migrations
Schema migration strategies for evolving applications including adding new fields, backfilling data, removing deprecated fields, index migrations, and zero-downtime migration patterns.
database-design-patterns
Database schema design patterns and optimization strategies for relational and NoSQL databases. Use when designing database schemas, optimizing query performance, or implementing data persistence layers at scale.
database-sql
Design database schemas, write efficient SQL queries, create migrations, and optimize database performance. Use when working with databases, writing queries, or designing data models.
data-design
Data modeling, schema design, and data architecture.