Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vanterx/mssql-performance-skills --skill sqlspn-reviewgit clone --depth 1 https://github.com/vanterx/mssql-performance-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vanterx/mssql-performance-skills/sqlspn-review)<a href="https://agentmods.dev/skills/vanterx/mssql-performance-skills/sqlspn-review"><img src="https://agentmods.dev/badge/skills/vanterx/mssql-performance-skills/sqlspn-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00183 | $0.12725 |
| Opus 5 | $0.00092 | $0.06363 |
| Sonnet 5 | $0.00037 | $0.02545 |
| Haiku 4.5 | $0.00018 | $0.01273 |
Grade B, and why
sqlspn-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **Fix:** `chown mssql /var/opt/mssql/secrets/mssql.keytab` and `chmod 440 /var/opt/mssql/secrets/mssql.keytab`. The keytab holds long-term key material equivalent to the service account password — a readable keytab is How it starts
The opening of the file, as written. The whole thing — 544 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SQL Server SPN and Kerberos Delegation Review Skill
Purpose
Analyze SQL Server SPN configuration and Active Directory delegation attributes to surface Kerberos authentication failures, NTLM fallback causes, and double-hop connectivity problems. Applies 54 checks (K1–K54) across eleven categories:
- K1–K6 — MSSQLSvc SPN presence: default instance, named instance, FQDN variant, short-hostname variant, port mismatch, and FCI Virtual Network Name
- K7–K11 — Service account binding: SPN on wrong account, duplicate SPNs, machine account vs domain account, stale SPNs from old accounts, MSA/gMSA auto-registration gaps
- K12–K16 — AG listener and alias: listener SPN, named instance port conflict, SQL Browser, alias SPN, multi-subnet listener coverage
- K17–K20 — Configuration and permissions: HTTP SPN, registration permission gap, unconstrained delegation, NTLM fallback signal
- K21–K25 — Kerberos delegation — service account: constrained delegation (KCD) not configured, missing target SPN, protocol transition, RBCD misconfiguration, delegation scope
- K26–K30 — AD account and computer sensitivity: AccountNotDelegated on end-user, Protected Users membership on end-user, computer account SPN conflict, computer account unconstrained delegation, service account in Protected Users
- K31–K40 — Entra ID / hybrid and advanced scenarios: Entra ID hybrid SPN gap, Entra-only auth with orphaned AD SPN, Azure SQL MI Windows Authentication flow, gMSA rollover drift, FCI node SPN leak, distributed AG forwarder SPN, TrustedToAuthForDelegation on an RBCD path, encryption type mismatch, AdminSDHolder SPN write block, DNS CNAME alias without SPN
- K41–K44 — Double-hop platform constraints: linked server RBCD unsupported, linked server constrained delegation version floor, SSISDB constrained delegation unsupported, named instance dynamic port
- K45–K48 — Kerberos environment prerequisites: clock skew, token size, RC4-only accounts under AES enforcement, forest boundary
- K49–K51 — SQL Server on Linux: keytab not configured, keytab encryption type mismatch, keytab ownership and permissions
- K52–K54 — Client driver and service state: legacy provider over named pipes, service account password change without restart, Report Server missing RSWindowsNegotiate
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +155 lines · +42 tokens per session scan A → B a2057a08195f
- 8d ago First seen · 389 lines · 141 tokens per session scan A c2665ce199a8
sqlspn-review is a skill published in the GitHub repository vanterx/mssql-performance-skills (5 stars, last pushed today), licensed MIT. It adds 183 tokens to every session and 12,725 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
oracle-expert
Expert in Oracle Database, PL/SQL programming, Oracle RAC, Data Guard, performance tuning, backup/recovery, and enterprise database administration. Use when the user mentions database, enterprise, ERP, PL/SQL, Oracle RAC, or Data Guard, or when the task involves Oracle Architecture, PL/SQL Programming, Performance &…
golang-performance
Use when profiling Go applications (pprof), running benchmarks, optimizing memory/CPU usage, or debugging performance bottlenecks in production Go code.
PostgreSQL Database Administration
Comprehensive PostgreSQL database administration skill for customer support tech enablement, covering database design, optimization, performance tuning, backup/recovery, and advanced query techniques.
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…