yd-sqlite-expert

yd-sqlite-expert is a skill for Codex from LeeYudok/doksam-skills. It costs 83 tokens per session (2,588 once invoked), scanned A, a copy of yd-sqlite-expert, MIT.

A SQLite specialist for working directly with SQLite database files. SQLite is a database stored in a file rather than served by a separate database process.

In plain words
What is it for?
Use it to inspect SQLite files safely, work with read-only queries and WAL mode, plan migrations, and avoid injection when table names are dynamic.
Why use it?
It helps prevent accidental changes to live data files and handles SQLite-specific issues such as read-only access, locks, WAL files, migrations, and unsafe table names.

Skill for Codex

Written for Codex: agents/openai.yaml present.

Good fit Use it to inspect SQLite files safely, work with read-only queries and WAL mode, plan migrations, and avoid injection when table names are dynamic.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/leeyudok/doksam-skills/yd-sqlite-expert
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add LeeYudok/doksam-skills --skill yd-sqlite-expert
Clone the repo
git clone --depth 1 https://github.com/LeeYudok/doksam-skills

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for yd-sqlite-expert

README.md
[![agentmods](https://agentmods.dev/badge/skills/leeyudok/doksam-skills/yd-sqlite-expert/github.svg)](https://agentmods.dev/skills/leeyudok/doksam-skills/yd-sqlite-expert)
Your own site
<a href="https://agentmods.dev/skills/leeyudok/doksam-skills/yd-sqlite-expert"><img src="https://agentmods.dev/badge/skills/leeyudok/doksam-skills/yd-sqlite-expert/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for yd-sqlite-expert

Your own site · 80×15
<a href="https://agentmods.dev/skills/leeyudok/doksam-skills/yd-sqlite-expert"><img src="https://agentmods.dev/badge/skills/leeyudok/doksam-skills/yd-sqlite-expert.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 83 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,588 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00083 $0.02588
Opus 5.5 $0.00033 $0.01035
Sonnet 5.5 $0.00017 $0.00518
Haiku 4.5 $0.00008 $0.00259

Measured 20d ago against content hash 92e3517a95cc, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

yd-sqlite-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/verify_sqlite_claims.py, tests/test_sqlite_claims.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to yd-sqlite-expert — 2 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

skills/yd-sqlite-expert/SKILL.md · 163 lines

How it starts

The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.

yd-sqlite-expert

SQLite 엔진 고유의 문제가 대상이다. 스키마 설계 이론은 yd-db-expert, PostgreSQL 은 yd-pg-expert, Go 코드 관용구는 yd-go-expert 가 맡는다.

SQLite 는 "작은 RDB"가 아니라 파일 하나가 데이터베이스인 라이브러리다. 서버가 없다는 사실에서 이 문서의 거의 모든 항목이 파생된다.

1. 남의 파일을 읽을 때 — 원본을 바꾸지 않는다

앱이 쓰고 있는 캐시·데이터 파일을 조회하는 작업이 흔하다. 원본을 건드리면 그 앱의 데이터가 깨진다. 기본은 읽기 전용이다.

dsn := "file:" + path + "?mode=ro&_pragma=busy_timeout(5000)"
  • mode=ro — 쓰기를 엔진 수준에서 막는다. 애플리케이션 규율에 기대지 않는다.
  • busy_timeout — 다른 프로세스가 쓰는 중이면 즉시 실패하지 않고 기다린다. 없으면 산발적인 database is locked 로 나타난다.
  • URI 파일명에서 ?·# 은 구분자다. 경로에 들어 있으면 퍼센트 인코딩한다. 그냥 이어붙이면 ? 앞까지를 경로로 읽어 엉뚱한 빈 파일을 새로 만들고, 뒤의 mode=ro 도 무시된다. 오류는 no such table 로만 나온다.

곁 파일까지 확인한다

읽기만 해도 -wal·-shm·-journal 이 생기면 원본 폴더를 오염시킨 것이다. 롤백 저널 DB 는 mode=ro 로 조회해도 곁 파일이 생기지 않는다. WAL 모드 DB 는 mode=ro 만으로 안 된다. 곁 파일이 없는 WAL DB 를 mode=ro 로 열면 SQLite 3.51.0 은 열기 자체가 unable to open database file 로 실패하고, 3.53.4 는 열리지만 -wal·-shm 을 만든다 (2026-10-04 실측). 읽기·쓰기 모드로 열면 조회만 해도 둘 다 생긴다.

정말 건드리면 안 되는 파일은 immutable=1 을 고려한다. 곁 파일 없이 읽힌다. 다만 이건 "파일이 변하지 않는다"는 약속이므로 앱이 쓰는 중이면 쓰지 않는다.

가장 안전한 순서: 사본을 떠서 사본을 연다. WAL DB 의 사본은 본 파일만으로는 모자란다 (7장). 그럴 수 없으면 mode=ro + 곁 파일 검사.

이건 테스트로 고정한다

문서에만 적힌 "읽기 전용"은 다음 리팩터링에서 사라진다. 회귀 테스트로 못 박는다.

// 조회란 조회를 다 돌린 뒤 파일 해시가 같은지, 곁 파일이 안 생겼는지
before := sha256sum(path)
// ... Rooms / Messages / Count / Search ...
if after := sha256sum(path); after != before { t.Error("원본이 바뀌었다") }
for _, s := range []string{"-wal", "-shm", "-journal"} {
    if _, err := os.Stat(path + s); !os.IsNotExist(err) { t.Error("곁 파일이 생겼다") }
}

쓰기가 실제로 막히는지도 확인한다 — mode=ro 로 연 뒤 DELETE 가 실패해야 한다.

2. 동적 테이블·컬럼명 — 유일한 방어선

테이블명은 플레이스홀더로 넘길 수 없다. 스키마가 Chat_<방ID> 처럼 데이터에 따라 갈리는 구조면 문자열 조립이 불가피하다. 그러면 검증이 유일한 방어선이 된다.

var roomIDRe = regexp.MustCompile(`^[0-9a-f]{12}-[0-9]{3}$`)

func tableName(id string) (string, error) {
    if !roomIDRe.MatchString(id) {   // 통과 못 하면 절대 쿼리에 넣지 않는다
        return "", fmt.Errorf("%w: %q", ErrInvalidRoomID, id)
    }
    return "Chat_" + id, nil
}
// 조립 시 반드시 인용부호로 감싼다 — 이름의 '-' 가 연산자로 파싱되는 것도 막는다
q := fmt.Sprintf(`SELECT ... FROM %q WHERE Sequence > ?`, table)

Read the full file on GitHub · 163 lines

Files

What ships with it

7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 20d ago First seen · 163 lines · 83 tokens per session scan A 92e3517a95cc

Subscribe to this mod's changes

yd-sqlite-expert is a skill published in the GitHub repository LeeYudok/doksam-skills (14 stars, last pushed 7d ago), licensed MIT. It adds 83 tokens to every session and 2,588 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to yd-sqlite-expert, differing in 2 lines, and is treated as a copy.

Related

Other skills, from other repositories