Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mr-mihu/codex-dbhub-plugin --skill dbhubgit clone --depth 1 https://github.com/mr-mihu/codex-dbhub-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mr-mihu/codex-dbhub-plugin/dbhub)<a href="https://agentmods.dev/skills/mr-mihu/codex-dbhub-plugin/dbhub"><img src="https://agentmods.dev/badge/skills/mr-mihu/codex-dbhub-plugin/dbhub/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mr-mihu/codex-dbhub-plugin/dbhub"><img src="https://agentmods.dev/badge/skills/mr-mihu/codex-dbhub-plugin/dbhub.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.01662 |
| Opus 5.5 | $0.00030 | $0.00665 |
| Sonnet 5.5 | $0.00015 | $0.00332 |
| Haiku 4.5 | $0.00008 | $0.00166 |
Grade A, and why
dbhub scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DBHub 数据库工具
前置要求（基础设施）
- 需要 Node.js（>= 18；DBHub 内置 SQLite 需要 >= 22.5）。mise / nvm / 系统安装都行。
- 没有 Node.js 时无法运行：提示用户自行安装（如
mise use -g node@22、nvm install 22或 https://nodejs.org），装好后重试。 - dbhub 本体：优先用本机已装的（mise / nvm / volta / npm 全局 / 项目 node_modules 都会自动找）；找不到时自动用
npx --yes @bytebase/dbhub@latest（保持最新版，升级 dbhub 不用改插件，需网络）。
直接使用（在项目根目录运行，不要 cd 到别处）
优先用启动器（它会先检查 node）：
Windows：
%USERPROFILE%\plugins\codex-dbhub-plugin\scripts\codex-dbhub-plugin.cmd
Linux / macOS：
$HOME/plugins/codex-dbhub-plugin/scripts/codex-dbhub-plugin
# 查数据（返回紧凑 JSON，单行数组）
& "$env:USERPROFILE\plugins\codex-dbhub-plugin\scripts\codex-dbhub-plugin.cmd" query 'SELECT id,name FROM users LIMIT 10'
# 列出表（可选模糊名）
& "$env:USERPROFILE\plugins\codex-dbhub-plugin\scripts\codex-dbhub-plugin.cmd" tables
& "$env:USERPROFILE\plugins\codex-dbhub-plugin\scripts\codex-dbhub-plugin.cmd" tables user
# 高级/自定义工具（先 list 看真实工具名，多源时带后缀如 execute_sql_prod）
& "$env:USERPROFILE\plugins\codex-dbhub-plugin\scripts\codex-dbhub-plugin.cmd" list
& "$env:USERPROFILE\plugins\codex-dbhub-plugin\scripts\codex-dbhub-plugin.cmd" call search_objects '{"object_type":"column","pattern":"%_id","detail_level":"summary"}'
Linux / macOS 把上面的 codex-dbhub-plugin.cmd 换成
$HOME/plugins/codex-dbhub-plugin/scripts/codex-dbhub-plugin（个人插件默认装在
~/plugins；参数完全一样），例如：
"$HOME/plugins/codex-dbhub-plugin/scripts/codex-dbhub-plugin" query 'SELECT id,name FROM users LIMIT 10'
找不到启动器时直接用 node 跑同目录的 codex-dbhub-plugin-client.mjs（把上面的 codex-dbhub-plugin.cmd 换成 node codex-dbhub-plugin-client.mjs）。
行为约定（省 token）
- 直接运行上述命令并返回结果即可；不要先跑 info、不要重复重试、不要额外诊断。
- 脚本已自动处理：本地 dbhub 查找（mise/nvm/volta/npm/项目）、找不到时 npx@latest 兜底、传输选择（默认 stdio）、环境透传、工具名解析（
query/tables自动匹配带后缀的工具名）、进程清理。 - 脚本结束时优雅关闭 DBHub：关闭 stdin 让它自行退出，超时才终止直接子进程；不会杀进程树或进程组，不会误伤其他应用。
- 安全红线：禁止自行扫描项目寻找数据库配置或凭据——不 grep 配置文件、不翻
.env、不去 nacos / SSH 服务器等外部系统找连接信息；发现敏感信息（密码、密钥、token）只提示存在，不展示内容、不用于连接。 - 报错即结论，按提示处理：
- “数据库连接被环境拦截（EACCES/…）”：沙箱访问不了数据库 → 用提权方式重跑同一条命令即可，一次到位。
- “没有数据库配置”：不要自行查找，只问用户一句：“当前目录没有数据库配置，请指定 DSN 或 DB_* 环境变量、告诉我配置在哪，或加 --demo 自测？”然后停下等用户答复；用户没答复就不继续。
- “找不到本地 dbhub”：
mise use -g npm:@bytebase/dbhub或设置DBHUB_BIN。 - 其他错误：把脚本输出原样告诉用户，不要自行猜测。
- 需要换数据源/端点等高级场景，环境变量已支持：
DBHUB_MCP_URL、DBHUB_DSN/DSN/DB_*、DBHUB_CONFIG、DBHUB_DEMO、DBHUB_AUTH_TOKEN、DBHUB_TRANSPORT、DBHUB_PREFER_NPX（强制用 npx 最新版）、DBHUB_NO_NPX（禁用 npx 回退）、DBHUB_VERSION（固定 npx 版本）、DBHUB_CONNECT_FIRST、DBHUB_MCP_TIMEOUT_MS（脚本默认已够用，一般不用设）。 - 凭据只在环境变量里，
info输出已打码；不要把凭据写进对话。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 82 lines · 76 tokens per session scan A 78d062709cf1
dbhub is a skill published in the GitHub repository mr-mihu/codex-dbhub-plugin (2 stars, last pushed 2mo ago), licensed MIT. It adds 76 tokens to every session and 1,662 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
accounting-software-selection
Scores shortlisted accounting packages against 57 evidence-backed fields, emitted as CSV, SQL, JSON Schema or Notion on request. Use for choosing accounting software.
360-feedback-system
360 feedback register: reviewer, subject, review cycle, visibility, due date and score, as CSV, SQL, JSON Schema or Notion on request. Use for 360 reviews or peer feedback cycles.
access-matrix
Access matrix of role-by-module permissions, with per-role scope, confidentiality level and SME tier, as CSV, SQL, JSON Schema or Notion on request. Use for access reviews.
admin-access-register
Admin account register: system, main and backup admin, seats, plan, 2FA, shared logins and access-review dates, as CSV, SQL, JSON Schema or Notion on request. Use for access reviews.
accounting-audit-system-builder
Routes an accounting or audit request to the right module skill, from software selection through monthly closing, asking only what is missing. Use for books of accounts or audit files.
advanced-analytics-dashboard
Dashboard metric register: metric, source module, formula, period, value, target, trend, owner and last-updated, as CSV, SQL, JSON Schema or Notion on request. Use for KPI dashboards.