Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add telus-labs/stagecraft --skill migration-safetygit clone --depth 1 https://github.com/telus-labs/stagecraftWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/telus-labs/stagecraft/migration-safety)<a href="https://agentmods.dev/skills/telus-labs/stagecraft/migration-safety"><img src="https://agentmods.dev/badge/skills/telus-labs/stagecraft/migration-safety.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.02415 |
| Opus 5 | $0.00047 | $0.01208 |
| Sonnet 5 | $0.00019 | $0.00483 |
| Haiku 4.5 | $0.00009 | $0.00242 |
Grade A, and why
migration-safety scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 187 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review a Migration
A structured safety review for changes that touch persistent state (schema files, migration directories, ALTER/CREATE/DROP TABLE DDL, ORM migration files). Runs as stage-04d, conditional on stage-04a's heuristic firing.
The pipeline guarantees you have a tested rollback before peer review sees the change. That's the whole point of this stage.
When to use this
- Orchestrator invokes the
migrationsrole for stage-04d (the normal path). - User explicitly asks "is this migration safe?" or "review this rollback plan."
When not to use this:
- General code review of business logic — that's
reviewerat stage-05. - Security-sensitive paths (auth / crypto / PII storage) — that's
security-engineerat stage-04b. The two stages cover different concerns; both may fire on the same migration. - Performance characteristics — that's red-team (stage-04c) or general review.
- A non-data-layer change: this skill exits cleanly and the stage skips.
Phase 1 — Load context
Read, in order:
pipeline/brief.md— does the brief mention the data change? Was it scoped intentionally, or is it a side effect?pipeline/design-spec.md— §Data model and §Rollback. The design's rollback section feeds this review; you're verifying the implementation against the plan.pipeline/pre-review.md—triggering_conditionslists the files that triggered the heuristic. Read all of them.- Each migration file. Read the actual SQL or ORM migration code, not just the diff.
- Currently-deployed code's expectations. Grep for SELECT/INSERT against the affected tables — what does running code assume?
Phase 2 — Walk the six questions
For every distinct migration in the diff, work through:
Q1 — What does this migration actually do?
One paragraph, plain English. If you can't summarize the migration in one paragraph, it's doing too much. Split it.
Q2 — Is it a breaking change?
Breaking iff currently-running code can't handle the new schema. Common breaking patterns:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 187 lines · 94 tokens per session scan A b6e34e954724
migration-safety is a skill published in the GitHub repository telus-labs/stagecraft (6 stars, last pushed 2d ago), licensed MIT. It adds 94 tokens to every session and 2,415 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
similarity-search-patterns
Implement efficient similarity search with vector databases. Use when building semantic search, implementing nearest neighbor queries, or optimizing retrieval performance.
postgres
Use this skill for any PostgreSQL database work — table design, indexing, data types, constraints, extensions (pgvector, PostGIS, TimescaleDB), search, and migrations. Trigger when user asks to: Design or modify PostgreSQL tables, schemas, or data models Choose data types, constraints, indexes, or partitioning…
vector-db
Vector database expert for embeddings, similarity search, RAG patterns, and indexing strategies.
elasticsearch
Elasticsearch expert for queries, mappings, aggregations, index management, and cluster operations.
mongodb
MongoDB operations expert for queries, aggregation pipelines, indexes, and schema design.
mongodb-connection
Optimize MongoDB client connection configuration (pools, timeouts, patterns) for any supported driver language. Use this skill when working/updating/reviewing on functions that instantiate or configure a MongoDB client (eg, when calling connect()), configuring connection pools, troubleshooting connection errors…