sql-architect — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sql-architect (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Targets PostgreSQL 18 as the primary engine; MySQL 9 and SQLite 3.53 noted where they differ. See STACK.md for pinned tool versions.
id UUID PRIMARY KEY DEFAULT uuidv7() on every table. UUID v7 is sortable, distributed-friendly, and doesn't leak counts via URLs. PG 18 has native uuidv7(); on earlier engines use an extension or app-generated UUID v7.id is for joins; domain meaning lives in UNIQUE constraints (email, slug, iso_code).REFERENCES other(id) ON DELETE RESTRICT by default). Never enforce relationships in app code alone.CHECK (price >= 0), CHECK (status IN (...))). They survive bad code paths.created_at + updated_at (timestamptz NOT NULL DEFAULT now()) on tables whose rows change after creation. Skip on pure lookup tables (countries, currencies) and event/log tables (where event_at alone is enough).deleted_at timestamptz NULL. Filter via partial indexes (CREATE INDEX ... WHERE deleted_at IS NULL) so queries stay fast. Use hard delete only when GDPR/compliance requires it, or for append-only event tables where deletion never makes sense.snake_case, plural (users, order_items).snake_case, singular (email, created_at).id.<reftable_singular>_id (user_id, order_id).ix_<table>_<cols>; unique ux_<table>_<cols>; partial ix_<table>_<cols>_active.<table>_<purpose>_check, <table>_<purpose>_fkey.WHERE a = ? and WHERE a = ? AND b = ? — but not WHERE b = ? alone.... WHERE deleted_at IS NULL) and other common filters.EXPLAIN ANALYZE proves a real query needs it.pg_stat_user_indexes periodically; remove any with idx_scan = 0.WHERE id = $1 — never string-concatenate user input.SELECT id, email, created_at FROM users — never SELECT * in production code (breaks on schema additions, returns extra bytes).INSERT ... RETURNING id, created_at saves a round-trip and surfaces server defaults.INSERT ... ON CONFLICT (email) DO UPDATE SET ... — atomic, no race.WHERE (created_at, id) < ($1, $2) ORDER BY created_at DESC, id DESC LIMIT 20. OFFSET is O(N) on every page.MATERIALIZED is forced.WHERE id IN (...) for the children, or DataLoader-style batchers if behind an API layer.EXPLAIN ANALYZE decide. Prefer JOINs when both sides return many rows; correlated subqueries when the inner table is small or you want a scalar.LEFT JOIN filtered by WHERE right.x = ? silently becomes an INNER JOIN — clearer to write it that way.READ COMMITTED (PG default). Bump to REPEATABLE READ for multi-statement reads that need a consistent snapshot, and SERIALIZABLE when reads-then-writes need true linearizability — handle 40001 (serialization failure) by retrying.pg_advisory_lock) for distributed coordination that doesn't fit a row-level lock — singleton workers, leader election, idempotent jobs.down migrations in production. Revert by writing a new forward migration. Down migrations rot fast and lie about what they restore.CREATE TABLE IF NOT EXISTS, ADD COLUMN IF NOT EXISTS. Lets a half-applied migration re-run safely.NNNNNN_snake_case_description.sql (e.g. 000023_add_orders_paid_at_index.sql). Number monotonically; pad enough to last.NOT NULL / index. Single ALTER TABLE ... NOT NULL on a billion-row table will lock writes for minutes.golang-migrate (Go) and alembic (Python) — both run raw .sql files. STACK.md pins versions.SELECT/INSERT/UPDATE/DELETE but should not CREATE/DROP/ALTER. Migrations run as a separate, elevated role.ENABLE ROW LEVEL SECURITY + policies keyed on a session variable holding tenant_id. Defense in depth against app-layer mistakes.~/.pgpass for local dev.Seq Scan on large tables (missing index?), high actual rows vs plan rows (stale stats — run ANALYZE), nested loops over huge inputs (wrong index).log_min_duration_statement = 200 (ms) in dev. Tighter in prod, but at least log the 99th percentile offenders.pgbouncer (transaction-mode for OLTP) in front; in-app pools (e.g. pgx, psycopg) for finer control.UPDATE/DELETE tables and tune autovacuum thresholds for them.data->'order'->>'status' repeatedly, it's a column, not a JSON field. Normalize.CREATE INDEX ... USING GIN (data jsonb_path_ops) for containment queries.PostgreSQL 18 is the primary target. Per-engine references are split out to keep this skill focused:
uuidv7(), etc.) — see POSTGRES.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.