Database Access Audit: Safety & Performance

    1

    Get a prioritized report on database access risks, supporting evidence, and recommended fixes.

    Free

    Security scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    Database Access Audit: Safety & Performance

    Example session with this skill installed

    Audit this PostgreSQL batch write: UPDATE invoices SET paid=true WHERE id=ANY($1). IDs come from customers. Table has tenant_id; no RLS or caller ownership check. Do not change code.

    • Read your context and instructions
    • Compiled the database access audit

    Reviewed the supplied statement in read-only mode. One high-priority isolation finding remains, based on your stated access controls.

    Audit report

    Scope and evidence: Supplied SQL and caller description only. Stack: PostgreSQL, user-specified. Driver, version, schema, and repository files were not provided.

    PriorityLocation and operationFindingEvidence and confidence
    P0Supplied UPDATE; one set-based batch writeCustomer-supplied IDs can target another tenant's invoices.No tenant predicate; you confirm no RLS or caller ownership check. High confidence given those facts.

    Counter-evidence and status: Parameter binding does not enforce ownership. The stated absence of other ownership controls leaves the finding survived within this limited scope; no independent repository verification was possible.

    Recommendation: Add an authenticated tenant predicate to the write. This retains the simple batch operation while restricting eligible rows. Decide how foreign or missing IDs should affect the response.

    Batch semantics: An empty PostgreSQL array matches no rows. Caller handling of empty input and affected-row results is unknown. The all-or-nothing contract is also unknown.

    Non-issue: This statement alone does not show looped I/O or N+1 queries. No business code changed.

    Next steps

    • Fix tenant scoping before performance work.
    • Test mixed-tenant IDs and empty batches in a test database.
    • Inspect the caller and driver to confirm rowcount and partial-success handling.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Database code can look correct while updating the wrong records or making too many queries. Get a prioritized review that shows where data access is risky, what supports each finding, and what to fix first.

    What it does

    • Finds data risks: Reviews account isolation, transactions, concurrent operations, and bulk changes.
    • Checks performance: Investigates repeated queries, N+1 access, large batches, and index support.
    • Explains findings: Provides code locations, supporting evidence, confidence, and practical fix recommendations.
    • Checks proposed shortcuts: Assesses whether bulk operations could skip required validation, events, or other business behavior.

    How it works

    1. Share your repository and name the service, endpoint, job, or area to review.
    2. Request an audit, or explicitly ask for code fixes.
    3. Receive a scoped report with priorities, uncertainties, and suggested validation.
    4. Use the recommended fix order to plan changes and tests.

    Works with

    Repository code, database schemas, migrations, tests, and available query logs. It does not assume a particular language, framework, ORM, or database engine.

    Why use this skill

    Spend less review time chasing suspicious-looking code that is actually safe. Findings are checked against surrounding code and available evidence, with data correctness considered before performance improvements.

    Use cases

    • Review a bulk update before release.
    • Investigate repeated queries in an endpoint.
    • Check account isolation in shared database tables.
    • Assess transaction safety in a background job.

    Known limitations

    The default review is static and read-only. Runtime behavior and performance may remain uncertain without logs, tests, or other supporting evidence.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Free forever

    No account required to browse

    Trust & safety

    Security scanned

    Verified clean 14 days ago

    • Free to download with an account

    Listed14 days ago
    Updated4 days ago

    What's inside

    Frequently Asked Questions