db-audit

Run the db-audit skill with no arguments for a full 13-dimension audit, or scope it with a path, file, or flags like --schema, --queries, or --connections. It detects your ORM and database engine automatically and produces a scored report with fixes ranked by impact.

The audit runs pattern scans for unbounded findMany calls, await-in-loop, and read-then-write race conditions, plus Prisma-specific EXPLAIN query simulation. These tool-verified checks catch N+1 and missing-index issues that manual review typically misses.

Yes, it supports Prisma, TypeORM, Drizzle, Sequelize, Knex, Django ORM, SQLAlchemy, and raw SQL clients. Each ORM has dedicated detection signals and specialized checks, such as Prisma schema analysis and Django model graph inspection.

Yes, pass --live with a connection string to enable EXPLAIN plans and statistics gathering. Live mode is strictly read-only: only SELECT and EXPLAIN queries are permitted, with no DDL or DML allowed.

The audit is read-only by design and never runs migrations, modifies schema files, or executes INSERT/UPDATE/DELETE statements. Its only write target is the audit report directory, so it cannot alter your database or code.

Use a code review skill for general code quality, a performance audit for full-stack latency, or a security audit for security-only concerns. This skill focuses specifically on database interactions, schema design, and migration safety.