用 Codex 或 Claude 帮你安装 复制这段 Prompt,粘贴到 Codex、Claude 或其他助手里,让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt;运行前请先检查来源。
npx skills add https://github.com/oimiragieo/agent-studio --skill database-expert命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地?可下载 SkillsMP 当前能够提供的文件。
Agent frontmatter enhancements — disallowedTools, mcpServers scoping, fork_eligible field
Context management — pre-compact persistence, threshold alignment, microcompact/circuit breaker detection
Hook enhancements — updatedInput for bash safety prefixes, suppressOutput for verbose blocks, denial-based routing feedback
正在显示 SKILL.md
基于 SOC 职业分类
| name | database-expert |
| description | Database expert including Prisma, Supabase, SQL, and NoSQL patterns |
| version | 1.2.0 |
| model | sonnet |
| invoked_by | both |
| user_invocable | true |
| tools | ["Read","Write","Edit","Bash","Grep","Glob"] |
| consolidated_from | 1 skills |
| best_practices | ["Follow domain-specific conventions","Apply patterns consistently","Prioritize type safety and testing"] |
| error_handling | graceful |
| streaming | supported |
| verified | true |
| lastVerifiedAt | "2026-03-15T00:00:00.000Z" |
| source | builtin |
| trust_score | 100 |
| provenance_sha | a361ffad126b532e |
When reviewing or writing code, apply these guidelines:
When reviewing or writing code, apply these guidelines:
When interacting with databases:
When reviewing or writing code, apply these guidelines:
When reviewing or writing code, apply these guidelines:
When reviewing or writing code, apply these guidelines:
When reviewing or writing code, apply these guidelines:
When reviewing or writing code, apply these guidelines:
You are familiar with latest features of supabase and how to integrate with Next.js application.
When reviewing or writing code, apply these guidelines:
When reviewing or writing code,
This expert skill consolidates 1 individual skills:
| Anti-Pattern | Why It Fails | Correct Approach |
|---|---|---|
| String-concatenated SQL queries | SQL injection vector; one unsanitized input compromises the database | Use ORM query builders or parameterized prepared statements |
| No RLS on multi-tenant tables | Any authenticated user can read/write other users' data | Enable RLS policies scoped to auth.uid() on all user-scoped tables |
Unbounded .findAll() / SELECT * without LIMIT | Returns entire table; causes timeouts and memory spikes on large datasets | Always paginate with LIMIT/OFFSET or cursor-based pagination |
| No connection pooling | Serverless functions exhaust database connections under load | Use PgBouncer / Supavisor in transaction mode |
| Logging full query strings with values | Leaks PII and credentials into log aggregators | Log query templates only; redact all bound parameter values |
Use official MCP servers to give agents direct database access without writing custom integration code.
# Quick start — no install required
npx -y @modelcontextprotocol/server-postgres postgresql://user:pass@localhost/mydb
# Claude Desktop / agent-studio settings.json
{
"mcpServers": {
"postgres": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-postgres", "${DATABASE_URL}"]
}
}
}
Available tools: query (read-only SELECT), list_tables, describe_table
Key design: read-only enforcement
The PostgreSQL MCP server wraps queries in BEGIN READ ONLY transactions, preventing accidental mutations. For write operations, build a custom MCP server with explicit write tools annotated destructiveHint: true.
Agent workflow pattern:
1. list_tables → discover available tables
2. describe_table → understand schema before querying
3. query → run SELECT with explicit column list + LIMIT
npx -y @modelcontextprotocol/server-sqlite /path/to/database.db
# settings.json
{
"mcpServers": {
"sqlite": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-sqlite", "/path/to/database.db"]
}
}
}
Available tools: read_query, write_query, create_table, list_tables, describe_table, insert_row, delete_rows
SQLite MCP usage patterns:
-- Discover schema
list_tables()
describe_table({ table_name: "users" })
-- Safe read pattern
read_query({ query: "SELECT id, name, email FROM users WHERE active = 1 LIMIT 100" })
-- Write with explicit columns (never INSERT SELECT *)
insert_row({ table_name: "users", data: { name: "Alice", email: "alice@example.com" } })
-- Conditional delete (always use WHERE)
delete_rows({ table_name: "sessions", where: "expires_at < datetime('now')" })
Security rules for SQLite MCP:
write_query and delete_rows calls in audit trail| Scenario | Use MCP Server | Build Custom |
|---|---|---|
| Agent needs to query a DB for context | MCP (postgres/sqlite) | No |
| Read-only exploration / analysis | MCP | No |
| Complex business logic + DB writes | No | Custom MCP with validated tools |
| Multiple DB operations in one transaction | No | Custom (MCP is single-op) |
| DB + external API in one workflow | No | Custom orchestration |
Before starting:
cat .claude/context/memory/learnings.md
After completing: Record any new patterns or exceptions discovered.
ASSUME INTERRUPTION: Your context may reset. If it's not in memory, it didn't happen.