dxkit-schema

dxkit-schema is a skill for Claude Code from vyuh-labs/dxkit. It costs 116 tokens per session (1,825 once invoked), scanned A, original, MIT.

A code-review guard for changes to data models, such as database entities and validation schemas. It detects breaking changes like removed fields or changed types before they reach a pull request.

In plain words
What is it for?
Use it to list recognized models, preview model drift, investigate a blocked change, and prepare a breaking change safely.
Why use it?
It helps catch model changes that could break stored data or other code. It also explains blocked changes and guides deliberate breaking changes through a migration and temporary risk record.

Skill for Claude Code

Written for Claude Code: installed under .claude/.

Good fit Use it to list recognized models, preview model drift, investigate a blocked change, and prepare a breaking change safely.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/vyuh-labs/dxkit/dxkit-schema
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add vyuh-labs/dxkit --skill dxkit-schema
Clone the repo
git clone --depth 1 https://github.com/vyuh-labs/dxkit

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for dxkit-schema

README.md
[![agentmods](https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-schema/github.svg)](https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-schema)
Your own site
<a href="https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-schema"><img src="https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-schema/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for dxkit-schema

Your own site · 80×15
<a href="https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-schema"><img src="https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-schema.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 116 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,825 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 4 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium MCP Rug Pull · line 22
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 31
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 39
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 51
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00116 $0.01825
Opus 5.5 $0.00046 $0.00730
Sonnet 5.5 $0.00023 $0.00365
Haiku 4.5 $0.00012 $0.00183

Measured 1mo ago against content hash 135b279b46b2, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

dxkit-schema scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

src-templates/.claude/skills/dxkit-schema/SKILL.md · 75 lines

How it starts

The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.

dxkit-schema

This skill owns the model-schema drift gate: dxkit statically extracts every declared data model (ORM entities, tagged structs, spec schemas) and fails a PR that changes one in a breaking way — a removed field, a changed type, an optional field made required, a removed model. Additive changes surface as warnings or information, never blocks.

It is thin orchestration over the deterministic CLI. It never re-implements extraction or diffing: it runs schema / schema diff / guardrail check, reads their structured output, and supplies judgment + code edits. The determinism stays in the CLI; the agent supplies the reasoning.

Language coverage. Recognition is marker-based per language pack — precision over recall. TypeScript/JavaScript: decorator-marked entity classes (TypeORM/MikroORM @Entity, sequelize-typescript @Table, NestJS-mongoose @Schema, type-graphql @ObjectType/@InputType) plus BaseEntity heritage; field facts from the type annotations. Python: Django models.Model, SQLAlchemy Base/DeclarativeBase, pydantic BaseModel, SQLModel, and @dataclass; Django/SQLAlchemy field constructors supply types and null=/nullable= optionality. Go: a struct tagged json:/gorm:/db:/bson: IS a wire contract; the tag supplies the wire name, omitempty and pointer types read as optional. Java: JPA @Entity/@Table/@Embeddable/@MappedSuperclass classes; @Column(nullable = …) supplies optionality and name = … the wire name — an unannotated column is an honest unknown (JPA defaults to nullable; dxkit never fabricates required). Kotlin: JPA annotations, kotlinx @Serializable data classes (incl. positional @SerialName("wire") names), and Exposed Table objects (fluent column chains — varchar("x", 50).nullable() reads type + optionality); String? nullability is read from the grammar, @Column overrides it. C#: [Table]/[Keyless]/[Owned] entities AND classes referenced by a DbContext's DbSet<T> properties; partial-class declarations assemble into one entity (codegen splits are never drift); string? NRT annotations supply optionality, positional [Column("x")]/[JsonPropertyName("x")] the wire names. Ruby (Rails): db/schema.rb is the model source — one entity per create_table, named by the TABLE (the wire contract), null: false ⇒ required and absence ⇒ nullable (the Rails default); the ActiveRecord class marker is discovery-only while a schema file exists. Rust: #[derive(Serialize/Deserialize)] structs; Option<T> optionality is precise, #[serde(rename = "x")] supplies wire names (rename_all/default container attributes are not read). Any other language — and unmarked DTOs in covered languages — participate via a spec: point .dxkit/policy.json:schema.specs at an OpenAPI (components.schemas) or JSON Schema document and its models are gated identically, no pack extraction needed.

What the gate does not see (tell the user honestly when relevant): unmarked plain interfaces/classes; dynamically-built schemas (disclosed in the inventory's dynamic list, not diffable); constraint-level changes (max length, enum members, validation rules, defaults); a type alias whose underlying type changed (comparison is lexical — resolving aliases would need a type-checker); serialization renames outside Go tags; migration files / raw SQL; whether anything actually consumes a removed field.

Read the full file on GitHub · 75 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 75 lines · 116 tokens per session scan A 135b279b46b2

Subscribe to this mod's changes

dxkit-schema is a skill published in the GitHub repository vyuh-labs/dxkit (10 stars, last pushed 1mo ago), licensed MIT. It adds 116 tokens to every session and 1,825 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

habit-hooks-prompting

Write or revise a habit-hooks coaching prompt. Use when a linter / knip / jscpd rule fires and the agent's default fix is wrong or shallow, or when adding a project-local override prompt. Keeps prompts short and outcome-focused using the ROSE pattern.

habit-hooks/habit-hooks · 61 tokens

prompt-optimization

Applies prompt repetition to improve accuracy for non-reasoning LLMs. Use when a Haiku or other non-reasoning agent misses details in a long prompt.

asklokesh/loki-mode · 39 tokens

mlops-patterns

Principal-level MLOps — feature stores, model registry, training pipelines, deployment patterns (online / batch / streaming), monitoring (drift, performance, fairness), CI/CD for models, A/B testing, rollback discipline. Treat models as software artefacts with full lifecycle management.

Nmor/the-claude-council · 61 tokens

temps-mcp-setup

Configure Temps as an MCP (Model Context Protocol) server so AI assistants can interact with a Temps instance directly -- listing/inspecting projects and deployments, and (when write mode is enabled) triggering deployments with human confirmation. Use when the user wants to: (1) Set up the Temps MCP server, (2)…

gotempsh/temps · 180 tokens

ring:adopting-lib-commons-huma-wrapper

Adopting the lib-commons/v5 shared Huma (OAS 3.1) OpenAPI wrapper + RFC 9457 problem model (commons/net/http/{openapi,problem}) in a Lerian Go service: wire openapi.New/ServeSpec + problem.Install (central >=500 scrub) on BOTH runtime and spec-gen paths, the per-rail problem.MapError flex seam, and rename-only spec…

LerianStudio/ring · 142 tokens

architecture-paradigm-pipeline

Applies pipes-and-filters for sequential data transformations. Use when data flows through discrete stages like ETL, streaming analytics, or CI/CD pipelines.

athola/claude-night-market · 37 tokens