Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ntygod/zhiwei/database-querynpx skills add ntygod/ZhiWei --skill database-querygit clone --depth 1 https://github.com/ntygod/ZhiWeiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ntygod/zhiwei/database-query)<a href="https://agentmods.dev/skills/ntygod/zhiwei/database-query"><img src="https://agentmods.dev/badge/skills/ntygod/zhiwei/database-query.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.00621 |
| Opus 5 | $0.00018 | $0.00311 |
| Sonnet 5 | $0.00007 | $0.00124 |
| Haiku 4.5 | $0.00004 | $0.00062 |
Grade A, and why
database-query scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
数据库查询指南
通过 shell_exec 调 sqlite3 / mysql / psql CLI 连接外部数据库执行 SQL。核心约束：默认只允许 SELECT；写操作必须用户确认。
适用场景
- 查询数据（SELECT）
- 写 / 优化 SQL 语句
- 导出查询结果（CSV / JSON）
- 分析库表结构（表 / 列 / 索引）
- 跨表关联（JOIN）/ 聚合（GROUP BY）
不适用场景
- 内存 CSV / Excel 分析 → data-analyst
- 日志文件分析 → log-analyzer
- 知微自身数据库（dataDir 下的 zhiwei.db）→ 用户没指明就不要碰
工作流（按场景分流）
| 场景 | 路径 |
|---|---|
| 第一次接触某库 | 先列表 → 再看 schema → 再写 SELECT |
| 已知表名查数据 | 直接写 SELECT，先 LIMIT 10 验证 → 全量 |
| 数据导出 | SELECT → CSV / JSON 落盘 |
| 写操作（INSERT/UPDATE/DELETE/DDL） | 先用 SELECT 看影响范围 → 用户确认 → 执行 |
| SQL 优化 | EXPLAIN 看执行计划 → 改写 |
各路径要点：
- 连接信息确认：类型（SQLite / MySQL / PostgreSQL）+ 地址 + 库名 + 用户；密码走环境变量
$DB_PASS，不明文 - 列表 / schema 探索：方言不同（SQLite
.tables/ MySQLSHOW TABLES/ PostgreSQL\dt），见参考 - 预览先 LIMIT 10：未知数据量 / 未验证条件先小样验证，确认正确再去 LIMIT 跑全量
- 写操作保护：INSERT / UPDATE / DELETE / DROP / TRUNCATE 必须用户明确确认；DDL（ALTER / CREATE / DROP TABLE）尤其要二次确认
- 大表导出限范围：> 10 万行先按时间 / ID 范围切，不要一次拉全表
详细参考
- SQLite / MySQL / PostgreSQL 方言命令、导出语法、常见错误：
{skill_dir}/references/dialect-reference.md
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 59 lines · 37 tokens per session scan A ad6bb5357fd1
database-query is a skill published in the GitHub repository ntygod/ZhiWei (137 stars, last pushed 23d ago), licensed MIT. It adds 37 tokens to every session and 621 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
inbox-triage
Summarize unread Gmail messages Alfred Core has already synced, and offer to draft or schedule follow-up actions -- never sends or deletes anything on its own.
morning-brief
Render Alfred Core's deterministic morning brief and deliver a short, warm rewrite of it without changing any fact, date, or link it contains.
weekly-review
Pull together the week's open tasks, GitHub notifications, Canvas missing assignments, and remembered context into one retrospective-style summary.
sqlite-schema-design
Design or review schemas for crates/cloudsync using SQLite Sync constraints, not generic SQLite advice. Use when adding synced tables, changing synced columns, or planning CloudSync-safe migrations.
reactive-sqlite-ui
Build SQLite-backed reactive UI in apps/desktop using stable patterns for reads, selection, forms, writes, and loading states. Use when implementing or reviewing screens built on useDrizzleLiveQuery and SQLite mutations.
migrate-to-sqlite
Migrate a TinyBase table to SQLite. Use when asked to move a data domain (e.g. templates, vocabs) from the TinyBase store to the app SQLite database.