- Home
- Skills
- Data & Databases
- Database Access Audit: Safety & Performance
Database Access Audit: Safety & Performance
Get a prioritized report on database access risks, supporting evidence, and recommended fixes.
Free
Works with the AI Agents you already use
Database Access Audit: Safety & Performance
Example session with this skill installed
Audit this PostgreSQL batch write: UPDATE invoices SET paid=true WHERE id=ANY($1). IDs come from customers. Table has tenant_id; no RLS or caller ownership check. Do not change code.
- Read your context and instructions
- Compiled the database access audit
Reviewed the supplied statement in read-only mode. One high-priority isolation finding remains, based on your stated access controls.
Audit report
Scope and evidence: Supplied SQL and caller description only. Stack: PostgreSQL, user-specified. Driver, version, schema, and repository files were not provided.
| Priority | Location and operation | Finding | Evidence and confidence |
|---|---|---|---|
| P0 | Supplied UPDATE; one set-based batch write | Customer-supplied IDs can target another tenant's invoices. | No tenant predicate; you confirm no RLS or caller ownership check. High confidence given those facts. |
Counter-evidence and status: Parameter binding does not enforce ownership. The stated absence of other ownership controls leaves the finding survived within this limited scope; no independent repository verification was possible.
Recommendation: Add an authenticated tenant predicate to the write. This retains the simple batch operation while restricting eligible rows. Decide how foreign or missing IDs should affect the response.
Batch semantics: An empty PostgreSQL array matches no rows. Caller handling of empty input and affected-row results is unknown. The all-or-nothing contract is also unknown.
Non-issue: This statement alone does not show looped I/O or N+1 queries. No business code changed.
Next steps
- Fix tenant scoping before performance work.
- Test mixed-tenant IDs and empty batches in a test database.
- Inspect the caller and driver to confirm rowcount and partial-success handling.
Connects securely to your tools. The creator never sees your data.
About this skill
Database code can look correct while updating the wrong records or making too many queries. Get a prioritized review that shows where data access is risky, what supports each finding, and what to fix first.
What it does
- Finds data risks: Reviews account isolation, transactions, concurrent operations, and bulk changes.
- Checks performance: Investigates repeated queries, N+1 access, large batches, and index support.
- Explains findings: Provides code locations, supporting evidence, confidence, and practical fix recommendations.
- Checks proposed shortcuts: Assesses whether bulk operations could skip required validation, events, or other business behavior.
How it works
- Share your repository and name the service, endpoint, job, or area to review.
- Request an audit, or explicitly ask for code fixes.
- Receive a scoped report with priorities, uncertainties, and suggested validation.
- Use the recommended fix order to plan changes and tests.
Works with
Repository code, database schemas, migrations, tests, and available query logs. It does not assume a particular language, framework, ORM, or database engine.
Why use this skill
Spend less review time chasing suspicious-looking code that is actually safe. Findings are checked against surrounding code and available evidence, with data correctness considered before performance improvements.
Use cases
- Review a bulk update before release.
- Investigate repeated queries in an endpoint.
- Check account isolation in shared database tables.
- Assess transaction safety in a background job.
Known limitations
The default review is static and read-only. Runtime behavior and performance may remain uncertain without logs, tests, or other supporting evidence.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Free forever
No account required to browse
Trust & safety
Security scanned
Verified clean 14 days ago
- Free to download with an account