Sql writing

Skill event4u-app/agent-config/dist/agent-src/skills/sql-writing

Universal AI Agent OS — audited skills, governance rules, replayable state. One contract, every host agent.

Install

npx -y skills add event4u-app/agent-config --skill sql-writing

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

7 stars7 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when writing raw SQL — MariaDB/MySQL syntax, parameterization, raw migrations, seeders with `DB::statement`; fires even on a pasted query asking 'why is this slow'.

SKILL.md

2.9 KB, 639 tokens by cl100k_base, as published. Nobody here has run it

sql

Grounded corpus: tuning decisions (indexes, keyset pagination, N+1, trigram search, lock contention) ground via the database corpus — ./scripts-run <skills-root>/corpus-grounding/scripts/ground search --manifest <skills-root>/database/data/manifest.json "<symptom>".

When to use

Use when writing or reviewing raw SQL queries, migrations with raw statements, or seeders with raw SQL.

Do NOT use when:

Eloquent/Query Builder queries (use eloquent or database skill)
Schema design (use database skill)

Procedure: Write raw SQL

Inspect call site & choose approach — identify every dynamic value flowing into the query, then pick: query builder when possible. Raw SQL only when query builder can't express the query.
Parameterize — Every variable must use ? binding or named :param. Never interpolate PHP variables into SQL strings.
Use MariaDB syntax — Not PostgreSQL or MSSQL. Check php/sql.md for MariaDB-specific patterns.
Verify — Run EXPLAIN on complex queries. Check that no PHP interpolation ("$var", '{$var}') appears in SQL.

NEVER build SQL strings with PHP variable interpolation or concatenation.
ALWAYS use parameterized queries or query builder.

Conventions

→ See guideline php/sql.md for parameterization patterns, common mistakes, MariaDB syntax reference.

Quick reference

// ✅ Safe
DB::select('SELECT * FROM users WHERE email = ?', [$email]);

// ❌ SQL injection
DB::select("SELECT * FROM users WHERE email = '{$email}'");

Validate

Verify every variable in SQL uses parameter binding (? or named :param).
Confirm MariaDB/MySQL syntax — not PostgreSQL or MSSQL.
Run EXPLAIN on complex queries to check index usage.
Check that no PHP variable interpolation ("$var", '{$var}') appears in SQL strings.

Output format

Parameterized SQL query using MariaDB/MySQL syntax
EXPLAIN output for performance-critical queries

Gotcha

MariaDB and MySQL have subtle syntax differences.
The model writes $variable in SQL strings instead of ? placeholders.
GROUP BY with ONLY_FULL_GROUP_BY requires all non-aggregated columns.
Use SQL types (NULL, 1/0, JSON_ARRAY()) — not PHP equivalents.

Do NOT

Do NOT interpolate PHP variables into SQL strings — always parameterize.
Do NOT use PHP syntax (arrays, booleans, null) in raw SQL — use SQL equivalents.
Do NOT write raw SQL when the query builder can express the same thing clearly.

Auto-trigger keywords

raw SQL
SQL query
parameterized query
MariaDB syntax
SQL injection