
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Install database skills onto coding agents (OpenCode, Claude Code, Codex, Cursor)
Built by Docfork
Curated database skills for AI coding agents (OpenCode, Claude Code, Codex, Cursor).
Each skill is a small, reviewable workflow in skills/<skill-name>/SKILL.md (with name + description frontmatter).
Think: schema discovery, safe migrations, debugging slow queries, and data quality checks.
npm install -g db-skills
# see what's bundled in this package
db-skills list
# install all bundled db skills (global)
db-skills add --all --global --yes
| Command | Purpose |
|---|---|
db-skills list | list bundled skills |
db-skills add | install selected skills (interactive by default) |
db-skills add --all | install all bundled skills |
db-skills rm / db-skills remove | uninstall selected skills |
| Option | Description |
|---|---|
-g, --global | install to user directories instead of the current project |
--agent <agents...> | target specific agents (e.g. cursor, claude-code) |
-s, --skill <skills...> | select skills by name (skip selection prompt) |
--mode <mode> | install mode: copy (default) or symlink |
-y, --yes | skip confirmation prompts |
# list skills
db-skills list
# install one skill globally to cursor + claude-code
db-skills add -g --agent cursor claude-code --skill query-database-schema
# install everything globally (ci-friendly)
db-skills add --all -g -y
# remove one skill globally
db-skills rm -g --skill query-database-schema -y
This CLI can install skills into these agent directories:
| Agent | --agent | Project Path | Global Path |
|---|---|---|---|
| Cursor | cursor | .cursor/skills/ | ~/.cursor/skills/ |
| Claude Code | claude-code | .claude/skills/ | ~/.claude/skills/ |
| Codex | codex | .codex/skills/ | ~/.codex/skills/ |
| OpenCode | opencode | .opencode/skills/ | ~/.config/opencode/skills/ |
./skills/<skill-name>/SKILL.md.agents/skills/<skill-name>/ (project) or ~/.agents/skills/<skill-name>/ (global)copy: copies from canonical store into each agent directorysymlink: symlinks each agent directory to canonical storeThis section is auto-generated from ./skills/*/SKILL.md. To refresh it, run npm run sync-skills.
| Skill | Purpose |
|---|---|
| data-quality-audit | Audits database data quality (nulls, duplicates, orphans, invalid ranges) and produces a short findings report with remediation queries |
| debug-slow-queries | Diagnoses and fixes slow database queries using explain plans, statistics, and targeted indexes or rewrites |
| query-database-schema | Inspects database schema and metadata (tables, columns, indexes, constraints, relationships) |
| write-safe-migrations | Plans and executes safe database migrations with low-downtime patterns, verification, and rollback |
This repo is curated. Skill requests and focused PRs are welcome.
CONTRIBUTING.mdskills/<skill-name>/SKILL.mdname and descriptionname matches the directory name exactlyMIT
FAQs
Install database skills onto coding agents (OpenCode, Claude Code, Codex, Cursor)
We found that db-skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.