Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add infraspecdev/tesseract --skill database-reviewgit clone --depth 1 https://github.com/infraspecdev/tesseractWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/infraspecdev/tesseract/database-review)<a href="https://agentmods.dev/skills/infraspecdev/tesseract/database-review"><img src="https://agentmods.dev/badge/skills/infraspecdev/tesseract/database-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/infraspecdev/tesseract/database-review"><img src="https://agentmods.dev/badge/skills/infraspecdev/tesseract/database-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.01068 |
| Opus 5.5 | $0.00026 | $0.00427 |
| Sonnet 5.5 | $0.00013 | $0.00214 |
| Haiku 4.5 | $0.00006 | $0.00107 |
Grade A, and why
backend-database-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Backend Database Review
Overview
Review database-related code for schema design (normalization, foreign keys, indexes), migration safety (zero-downtime, additive-only on hot paths), ORM entity correctness (fetch strategy, equals/hashCode, cascades), and query patterns (N+1, full table scans, missing pagination).
Framework-agnostic: applies to JPA/Hibernate, SQLAlchemy, ActiveRecord, Sequelize, GORM, raw SQL.
When to Use
- Reviewing changes to entity/model classes
- Reviewing repository/DAO methods
- Auditing migration files (Flyway, Liquibase, Alembic, Rails migrations)
- Pre-implementation: shaping schema during planning
When NOT to Use
- Pure runtime DB tuning (query plans, vacuum, replication) — operational concern
- NoSQL document modeling (separate skill not in v1)
- Reviewing application logic that uses DB results without DB code itself
Review Process
- Inventory: entities, repositories/DAOs, migration files, query strings
- For each artifact, apply Evaluation Points D1–D10
- Cross-cut: detect N+1 risk by reading entity fetch type alongside repo methods
- Group findings by file and migration version
Evaluation Points
| # | Check | What to Look For | Severity |
|---|---|---|---|
| D1 | Schema normalization | 3NF for OLTP unless explicit denormalization for read perf. Flag obvious anti-normalization (CSV in a column, repeating groups) | Medium |
| D2 | Foreign key integrity | FKs declared on every reference. Flag soft references via _id columns without FK |
High |
| D3 | Index coverage | Indexes on lookup columns, FK columns, columns used in WHERE/ORDER BY. Flag obvious missing indexes | High |
| D4 | Column constraints | NOT NULL where appropriate, UNIQUE where business rules require, length limits for VARCHAR | Medium |
| D5 | ORM fetch strategy | LAZY by default for relationships; EAGER only with explicit justification. Flag EAGER on collections | High |
| D6 | N+1 query risk | Repository methods that load parents and lazy-load children one-by-one. Suggest fetch join or @EntityGraph |
High |
| D7 | Pagination on list queries | List endpoints support pagination. Flag findAll-style on tables that grow unbounded |
Medium |
| D8 | Migration safety (additive vs destructive) | Adds are safe; drops/renames need expand/contract pattern across two deploys | High |
| D9 | Transaction boundaries | Read methods marked readOnly where applicable; write methods scope tx narrowly. Flag ambient/no-tx writes | Medium |
| D10 | equals/hashCode on entities | Use natural keys or business identifiers; avoid using auto-generated ID before persistence (HashSet bugs) | Medium |
| D11 | Explicit table/column naming | Entities should declare @Table(name=...) and key @Column(name=...) to prevent schema drift when class names change |
Medium |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 81 lines · 64 tokens per session scan A 45d1f63168ce
backend-database-review is a skill published in the GitHub repository infraspecdev/tesseract (5 stars, last pushed 3mo ago), licensed MIT. It adds 64 tokens to every session and 1,068 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
event-store-design
Design and implement event stores for event-sourced systems. Use when building event sourcing infrastructure, choosing event store technologies, or implementing event persistence patterns.
convex-explain-app
Explain an existing Convex app — data model + relationships, public vs internal functions, auth/ownership model, components, a request→data flow — read from the schema and function surface. Read-only.
platform-custom-field-generate
Use when users create, generate, or validate Salesforce Custom Field metadata. Trigger on custom fields, field types, Roll-Up Summary, Master-Detail/Lookup relationships, formula fields, picklists, dependent (controlling) picklists, referencing a value set from a field, or scoping picklist values per record type; also…
field-service-sobject-create-configure
Headless 360 REST API deployment step for creating sObject records. Handles describe-based field discovery, required-field derivation, entity-relationship ordering, and composite graph transactions. Use this skill when a designer skill (or a user directly) needs to create sObject records after design confirmation…
durable-objects
Build, debug, or review Cloudflare Durable Objects code for persistent state and coordination.
nornicdb-grpc
Drive NornicDB over gRPC — the Qdrant-compatible surface (Collections, Points, Snapshots) plus the additive NornicSearch service. Use when ingesting via Qdrant SDKs, migrating from Qdrant, or running hybrid text+vector search from a non-Bolt client. Covers connection, RPC catalog, collection→database mapping…