sqlx-code-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sqlx-code-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
runtime-tokio, tls-rustls/tls-native-tls, postgres/mysql/sqlite, uuid, chrono, json, migrate) and Rust edition (2024 changes RPIT lifetime capture and removes need for async-trait)query!, query_as!) vs runtime (query, query_as)Complete in order; do not assign Critical / Major until the gate for that claim is passed.
Cargo.toml path) and the .rs files (or directory) you opened. Pass: At least one concrete path you inspected is named.query! / query_as!, offline mode, sqlx.toml, DATABASE_URL, or Cargo features: open the relevant Cargo.toml and, if applicable, sqlx.toml or documented env. Pass: The finding cites a line or you state that those files were absent / out of scope.[FILE:LINE] per Output Format. Pass: No Critical or Major without a line reference.Report findings as:
[FILE:LINE] ISSUE_TITLE
Severity: Critical | Major | Minor | Informational
Description of the issue and why it matters.| Issue Type | Reference |
|---|---|
| Query macros, bind parameters, result mapping | references/queries.md |
| Migrations, pool config, transaction patterns | references/migrations.md |
query!, query_as!) used where possiblesqlx.toml or DATABASE_URL configured for offline compile-time checking$1, $2)query_as! maps to named structs, not anonymous records, for public APIs.fetch_one(), .fetch_optional(), .fetch_all() chosen appropriately.fetch() (streaming) used for large result setsPgPool shared via Arc or framework state (not created per-request)std::sync::LazyLock (not once_cell::sync::Lazy or lazy_static!) for static pool singletonspool.begin() used for multi-statement operationstx.begin()) if neededsqlx::Type derives match database column typesUuid, DateTime<Utc>, Decimal types used (not strings for structured data)Option<T> used for nullable columnsserde_json::Value used for JSONB columnsgen — reserved keyword in edition 2024 (use r#gen with #[sqlx(rename = "gen")] or choose a different name)-> impl Stream or -> impl Future account for RPIT lifetime capture changes (all in-scope lifetimes captured by default; use + use<'a> for precise control)FromRow or Type trait impls use native async fn in traits where applicable (no #[async_trait] needed, stable since Rust 1.75)#[expect(unused)] over #[allow(unused)] for compile-time query fields only used in some code paths (self-cleaning lint suppression, stable since 1.81)std::sync::LazyLock (not once_cell or lazy_static!)YYYYMMDDHHMMSS_description.sql)sqlx::migrate!() called at application startupquery()) where compile-time (query!()) could verify correctness.fetch_all() on potentially large tablesgen without r#gen escape (edition 2024 compile failure).fetch_optional() (using .fetch_one() then handling error for "not found")SELECT * when only specific columns neededonce_cell::sync::Lazy or lazy_static! used where std::sync::LazyLock works#[allow(unused)] instead of #[expect(unused)] for query fields (prefer self-cleaning lint suppression)query_as! for type-safe result mappingquery_as! for reusable row typessqlx::Type derive, simpler than custom SQL typesgen columns in database typesonce_cell/lazy_static (stable since Rust 1.80)async-trait crate no longer needed (stable since Rust 1.75)Complete Gates (evidence before severity), then load and follow the review-verification-protocol skill before reporting any issue.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.