Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add khasky/awesome-agent-skills --skill awesome-database-auditgit clone --depth 1 https://github.com/khasky/awesome-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/khasky/awesome-agent-skills/awesome-database-audit)<a href="https://agentmods.dev/skills/khasky/awesome-agent-skills/awesome-database-audit"><img src="https://agentmods.dev/badge/skills/khasky/awesome-agent-skills/awesome-database-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/khasky/awesome-agent-skills/awesome-database-audit"><img src="https://agentmods.dev/badge/skills/khasky/awesome-agent-skills/awesome-database-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00134 | $0.02423 |
| Opus 5 | $0.00067 | $0.01211 |
| Sonnet 5 | $0.00027 | $0.00485 |
| Haiku 4.5 | $0.00013 | $0.00242 |
Grade A, and why
awesome-database-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Database Audit
Audit a database layer — schema, queries, migrations, and the operational habits around them — for the design defects that surface as slow queries, silent data corruption, and unrunnable migrations in production. Read-only: it reports findings and a verdict; it never edits schema, data, or code. Works from the repo's schema files, migrations, and query sites; a live connection is optional and read-only when present.
Evidence, not taste. Every finding cites its artifact — a file:line in a migration or model, a query site, a schema definition, an EXPLAIN output if a connection exists. A "smelly" table name is a lead; confirm the defect (the missing constraint, the unindexable predicate) before flagging.
Four audit tracks — run the ones in scope:
- A. Schema design — types, keys, and the anti-pattern catalog.
- B. Query patterns and indexes — what the code asks, and whether an index can answer it.
- C. Integrity and concurrency — constraints, transactions, locking strategy.
- D. Migrations and operations — evolution, restore path, seeds, pooling.
Scope and method
- Establish scope — the whole schema, one domain's tables, or the migration history. Name it; findings without a boundary don't prioritize.
- Locate the source of truth — schema files, ORM models, migration directory; note the engine and version (Postgres/MySQL/SQLite behave differently and some findings are engine-specific — say which).
- Read the project's own words — its glossary (
CONTEXT.md, a domain doc) or the vocabulary its models, tests and API already use, and name every finding in those terms; a table or column that contradicts the glossary's own definition is itself a finding, and a report that renames the domain makes the reader translate before they can act. - Read schema before queries — a table designed wrong makes every query against it a finding; start where the defects multiply.
- Grep the query sites — ORM calls and raw SQL both; an anti-pattern that never runs on a hot path is a note, not a FIX. Zero hits is not proof of absence — ripgrep honors
.gitignore; re-scan with ignores off before concluding. - Score, gate, report — see Output.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed d7f52f31497f
- 5d ago Changed · +3 lines · -62 tokens per session eef8bdbde273
- 8d ago First seen · 98 lines · 196 tokens per session scan A 6f72a462dc90
awesome-database-audit is a skill published in the GitHub repository khasky/awesome-agent-skills (8 stars, last pushed yesterday), licensed MIT. It adds 134 tokens to every session and 2,423 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
deprecation-and-migration
Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another. Use when migrating a database schema in production, such as renaming or dropping a column without downtime (expand/contract). Use when deciding whether to maintain or sunset…
signoz-writing-clickhouse-queries
Write raw ClickHouse SQL for a SigNoz dashboard panel: timeseries, value, or table widgets that the builder UI cannot express (custom joins, window functions, regex extraction over log bodies, aggregations beyond builder syntax). Trigger when the user explicitly asks for a "ClickHouse query", a "raw SQL panel", a…
reopt-eav
EAV schema status, sync, pull, diff, file-based migrations (plan/migrate/history/verify), record inspection and pruning (eav records list/get/count/delete-where), and destructive-change guardrails for reopt Brandapp projects. Use when a task involves reopt brandapp eav status, sync, pull, diff, plan, migrate, history…
data-engineering
Guides data pipeline design, ETL/ELT workflows, schema evolution, and data quality assurance. Use when building data pipelines, designing data warehouses, migrating schemas, or ensuring data integrity across systems. Use when you need reliable, testable, and observable data flows.
postgres-ops
Operate a production Postgres database — backup strategy, point-in-time recovery, restore drills, connection pooling for serverless, and a disaster-recovery runbook. Use when asked to set up Postgres backups, plan disaster recovery, configure connection pooling, restore a database, or harden Postgres for production.…
redis-caching
Redis caching, rate limiting, session storage, pub/sub, and production integration patterns for TypeScript, Next.js, NestJS, and Prisma applications. Use when adding cache-aside or write-through caching, rate limiting, session or lock storage, pub/sub fanout, or reviewing Redis key design and TTLs.