Review SQL for safety (prompt)

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-sql-safety-prompt/raw' -o ~/'.claude/skills/review-sql-safety-prompt/SKILL.md' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-sql-safety-prompt/files/LICENSE.txt' -o ~/'.claude/skills/review-sql-safety-prompt/LICENSE.txt'

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-sql-safety-prompt/raw' -o '.cursor/skills/review-sql-safety-prompt/SKILL.md' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-sql-safety-prompt/files/LICENSE.txt' -o '.cursor/skills/review-sql-safety-prompt/LICENSE.txt'

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-sql-safety-prompt/raw' -o '.agents/skills/review-sql-safety-prompt/SKILL.md' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-sql-safety-prompt/files/LICENSE.txt' -o '.agents/skills/review-sql-safety-prompt/LICENSE.txt'

{
  "mcpServers": {
    "theskillvault": {
      "url": "https://theskillvault.ai/mcp"
    }
  }
}

SQL bugs are quiet until they are expensive: a leaked table, a dropped column or a query that locks checkout. This prompt makes the AI review database code like a careful senior engineer.

When to use

• Your app builds SQL strings or uses raw queries next to an ORM.
• A migration is about to run against production.
• You inherited stored procedures, views or reports nobody has read in a while.

When not to use

• A query is correct but slow. Use optimise-slow-sql-queries to read the plan.
• You want the whole pull request reviewed. Use review-code-prompt.

Steps

1. Open the files with SQL in your AI tool, or paste the queries and the related table definitions.
2. Tell it which database and version you run, such as Postgres 16 or MySQL 8.
3. Paste the prompt below.
4. Fix critical and high findings first, and add a test for each injection fix.
5. Re-run the prompt on the changed code until no critical or high items remain.

Prompt

Review the SQL in the files I shared (queries in app code, migrations, views, functions). Database: [Postgres 16 / MySQL 8 / SQL Server / SQLite].

Check, in this order:
1. Injection: any SQL built by joining strings or formatting user input. Show the parameterised version.
2. Access: queries that skip a tenant or owner filter, roles with more rights than they need, functions running as the owner.
3. Data exposure: SELECT * on tables with personal or secret columns, sensitive data returned to the client or logged.
4. Integrity: missing NOT NULL, foreign keys, CHECK or UNIQUE constraints the code relies on.
5. Migrations: destructive steps (DROP, type changes, NOT NULL on a full table) without a backup or a safe order.
6. Correctness: implicit cross joins, DISTINCT hiding duplicate rows, NULL comparisons with =, time zone mistakes.
7. Anti-patterns: queries inside loops (N+1), functions on indexed columns in WHERE, unbounded result sets.
8. Readability: naming, formatting and comments only where they would prevent a mistake.

For each finding give: severity (critical, high, medium, low), file and line, what can go wrong in one sentence, and the fixed SQL.
Sort by severity. Do not invent problems; if a section has none, say "none found".
Do not rewrite unrelated code, and never echo real credentials or data you find.

How to adapt

• Using an ORM? Ask it to review the raw SQL fragments and the generated queries for the hot paths.
• Multi-tenant app? Make check 2 the first item and list your tenant column.
• Reviewing only a migration? Keep checks 4 and 5 and ask for a rollback plan.
• On Postgres? Add a check 9: JSONB queried with ->> and no matching index (use @> with a GIN index), arrays searched with ANY() and no GIN index, timestamp instead of timestamptz, free-text status columns that want a CHECK or enum, tables with tenant data but no row level security, GRANT ALL to the app role, and triggers that fire on every update.

Gotchas

• Parameter placeholders only cover values. Table or column names chosen by users need an allow-list.
• Connection strings and passwords in migration or seed files count as a finding. Move them to environment variables.
• The AI cannot see your real data volumes. Treat "this will be slow" findings as a prompt to check with EXPLAIN.

Portability

Works with any SQL database and any chat AI or coding agent. If you use another database, swap the version line and keep the checks.

Done when

• No critical or high findings remain, and every injection fix has a test.
• Migrations have a safe order and a backup or rollback note.
• Sensitive columns are no longer selected or returned where they are not needed.

Example prompt

"Review the SQL in our reports module and the migrations folder for injection, missing tenant filters and risky migrations. We use Postgres 16."

---

Adapted from "sql-code-review" in github/awesome-copilot (MIT, Copyright GitHub, Inc.). The Postgres adapt note draws on "postgresql-code-review" in the same repo (MIT, Copyright GitHub, Inc., original prompt by shubham070): https://github.com/github/awesome-copilot/blob/61fa1fa8fcc63d6dbd2f07a75aeb8e214df5acfb/skills/postgresql-code-review/SKILL.md. See LICENSE.txt.

Bundled files

• LICENSE.txt

Licence

Adapted from shubham070 (github/awesome-copilot, sql-code-review); later edits by CypherHK and derekclair (Copyright GitHub, Inc.), MIT License. Adapted by TheSkillVault on 2026-11-02: rewritten as one copy-paste review prompt with a severity scale and output format; the per-database example blocks and emoji headings were dropped; added steps, adapt notes, gotchas and done-when. On 2026-11-03 a Postgres adapt note was added, drawing on postgresql-code-review (github/awesome-copilot@61fa1fa, MIT, same author). Not the original file.

Licence: MIT License. Attribution when you reuse it: Based on work by shubham070 (github/awesome-copilot, sql-code-review); later edits by CypherHK and derekclair (Copyright GitHub, Inc., MIT License), https://github.com/github/awesome-copilot/tree/5269f7ea2d6c3a9bfda5ed878b6726cf509121fd/skills/sql-code-review; adapted by TheSkillVault, https://theskillvault.ai