MateClaw is a pluggable agent runtime that coordinates AI agents, tools, conversations, memory, and workflows. It is designed for personal and multi-user AI assistants, including agents used through chat platforms. Catalogue add-ons provide skills for extending its agent workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mateaix/mateclaw --skill sql_querygit clone --depth 1 https://github.com/mateaix/mateclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mateaix/mateclaw/sql_query)<a href="https://agentmods.dev/skills/mateaix/mateclaw/sql_query"><img src="https://agentmods.dev/badge/skills/mateaix/mateclaw/sql_query/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mateaix/mateclaw/sql_query"><img src="https://agentmods.dev/badge/skills/mateaix/mateclaw/sql_query.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.00807 |
| Opus 5.5 | $0.00022 | $0.00323 |
| Sonnet 5.5 | $0.00011 | $0.00161 |
| Haiku 4.5 | $0.00005 | $0.00081 |
Grade A, and why
sql_query scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
SQL 查询技能
当用户提出与数据查询相关的问题时,按照以下工作流程操作。
工作流程
第一步:发现数据源
调用 query_datasource(action='list_datasources') 查看所有可用的外部数据源。
- 如果只有一个数据源,直接使用它
- 如果有多个数据源,根据用户问题推断最相关的数据源;不确定时询问用户
第二步:发现表结构
调用 query_datasource(action='list_tables', datasourceId=<id>) 查看数据源中的表列表。
- 根据表名和注释判断与用户问题相关的表
- 不要一次查看所有表的结构,只查看相关的 2-3 张表
第三步:查看列详情
调用 query_datasource(action='describe_table', datasourceId=<id>, tableName='<表名>') 查看列名、类型和注释。
- 记住列名和类型,生成 SQL 时必须使用正确的列名
第四步:生成 SQL
根据表结构和用户问题,生成 SELECT SQL。遵循以下规则:
SQL 生成规则:
- 仅生成 SELECT 语句,绝不生成 INSERT/UPDATE/DELETE/DROP 等写操作
- 多表查询时,所有字段必须用表别名限定(如
t1.name) - 聚合查询使用 COUNT/SUM/AVG/MAX/MIN 等函数
- 时间过滤使用数据库对应的日期函数
- 字符串匹配使用 LIKE 并注意大小写
- 结果默认按合理的顺序排序(如时间倒序)
- 系统会自动注入 LIMIT 500,无需手动添加(除非用户指定了数量)
不同数据库的注意事项:
- MySQL:日期用
DATE_FORMAT()、NOW(),字符串连接用CONCAT() - PostgreSQL:日期用
TO_CHAR()、NOW(),字符串连接用|| - ClickHouse:日期用
toDate()、today(),注意不支持部分标准 SQL 语法
第五步:执行查询
调用 execute_sql(datasourceId=<id>, sql='<SQL>') 执行查询。
第六步:解读结果
- 用自然语言总结查询结果的要点
- 如果结果为空,分析可能的原因(表名/列名/条件有误等)
- 如果需要,可以调整 SQL 重新查询
- 如果查询结果包含数值列,系统会自动生成 ECharts 图表,无需你手动生成图表代码
- 重要:不要使用 write_file 工具生成 HTML 图表文件,系统已内置图表渲染能力
错误处理
如果 SQL 执行失败:
- 仔细阅读错误信息
- 常见原因:列名拼写错误、类型不匹配、语法错误
- 根据错误修正 SQL 并重试一次
- 如果仍然失败,向用户说明错误原因
安全须知
- 本工具仅支持只读查询(SELECT),写操作会被系统拒绝
- 查询结果默认限制为 500 行
- 查询超时为 30 秒
- 如果用户要求执行写操作,应礼貌拒绝并说明这是安全限制
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 72 lines · 54 tokens per session scan A 0311a56b075d
sql_query is a skill published in the GitHub repository mateaix/mateclaw (1,161 stars, last pushed yesterday), licensed Apache-2.0. It adds 54 tokens to every session and 807 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
redteam-sqli-detail-pack
Domain routing and boundary guidance for authorized SQL injection testing, including union-based, blind, error-based, stacked query, and second-order SQL injection variants. Use when a task belongs to the SQL injection domain and needs scope, evidence, pivot, or exit criteria.
oma-db
Design schemas and migrations, tune queries, or plan vector retrieval and database operations. Application API implementation uses oma-backend.
sql-explainer
Paste a SQL query and get a plain English explanation of what it does.
vector-db
Vector database expert for embeddings, similarity search, RAG patterns, and indexing strategies.
elasticsearch
Elasticsearch expert for queries, mappings, aggregations, index management, and cluster operations.
mongodb
MongoDB operations expert for queries, aggregation pipelines, indexes, and schema design.