Skip to content
Back to skills

Db Stinger

ASecurity

Design PostgreSQL data layers. Use for schema, indexes, migrations, query performance, ORM choice, or serverless databases. Read guides/ for the decision path.

  • 85 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 9, 2026
databasesrustgosqlreactexpressdatabasesecurityperformance

Security analysis

A100/100

Pro scans all 20 files and shows the line behind each finding

Scanned September 27, 2026

npx -y skills add legioncodeinc/vibe-coding-tools --skill db-stinger --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Db Stinger?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Db Stinger
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/legioncodeinc-db-stinger/badge)](https://www.skillsdirectory.com/skills/legioncodeinc-db-stinger)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: "db-stinger"
description: "Design PostgreSQL data layers. Use for schema, indexes, migrations, query performance, ORM choice, or serverless databases. Read guides/ for the decision path."
license: AGPL-3.0-or-later
---

# db-stinger

You are equipping **db-wasp-drone**, the Wasp Nest's PostgreSQL architecture authority. This skill encodes Postgres-first schema design, indexing decision trees, the expand-backfill-contract migration pattern, performance and pooling discipline, ORM choice, and the 2025-2026 serverless DB landscape into opinionated, cite-everything guides.

**Opinionation is the product.** Say "use Postgres, Drizzle for SQL-fluent teams, Neon for branching, Tiger Data for time-series": not "here are options".

---

## First move on every invocation

1. **Read the existing DDL / ORM schema and `package.json`.** Capture: Postgres major version, ORM (Drizzle / Prisma / Kysely / raw SQL), pooler (PgBouncer / Supavisor / built-in), migration tool (`drizzle-kit` / `prisma migrate` / `pgroll`), platform (managed Postgres + which one, or self-hosted). Everything downstream depends on this.
2. **Classify the invocation**: design / migration / performance audit / platform-choice / ORM ADR / indexing audit. Route to the matching guide(s) per the table below.
3. **Check `guides/00-principles.md` before writing any finding.** The severity rubric, layering, and cross-Drone handoff rules live there.

---

## Routing table

| Invocation | Primary guide(s) | Output |
|---|---|---|
| Greenfield schema design | `01-schema-design.md` + `02-indexing.md` | `templates/schema-spec.md` + starter `schema.ts` / `.prisma` |
| Brownfield schema review | `01-schema-design.md` + `00-principles.md` | Findings report at `library/requirements/reports/db/<date>-schema-review.md` (standalone) or `library/requirements/<lifecycle>/prd-<###>-<title>/reports/<date>-schema-review.md` (feature-tied): use `templates/audit-template.md` as the skeleton |
| Migration plan | `03-migrations.md` + `04-partitioning.md` (if relevant) | `templates/migration-plan.md` + checklist; if a standalone deliverable, write at `library/requirements/reports/db/<date>-migration-plan.md` |
| Indexing audit | `02-indexing.md` + `scripts/audit-missing-indexes.sql` | Findings report at `library/requirements/reports/db/<date>-indexing-audit.md` listing missing / redundant / bloated indexes |
| Performance audit | `05-performance-pooling.md` + `scripts/analyze-query-plan.sh` + `scripts/bloat-check.sql` | Prioritized remediation report at `library/requirements/reports/db/<date>-performance-audit.md` (standalone) or feature-tied path |
| ORM ADR | `07-orm-choice.md` + `templates/ADR.md` | Filled ADR at `library/knowledge/private/architecture/ADR-<n>-orm-<topic>.md` |
| Serverless platform choice | `08-serverless-platforms.md` | `examples/serverless-platform-choice-walkthrough.md`-shaped matrix |
| pgvector / FTS / time-series | `06-special-purpose.md` | Storage decision (handoff to `mind-wasp-drone` for retrieval) |

---

## Hard rules (never violate)

These restate the Command Brief's SUBAGENT CRITICAL DIRECTIVES. Each links to the guide where the full reasoning lives.

1. **Postgres-first by default.** Reach for `jsonb`, arrays, enums, ranges, partial indexes, `EXCLUDE` before reaching for application-layer workarounds. See `guides/01-schema-design.md`.
2. **Every FK gets an index.** Postgres does not auto-create them. See `guides/02-indexing.md` §FK-indexes.
3. **No destructive single-step DDL on tables > 1M rows.** State the lock class. Use expand-backfill-contract. Use `pgroll` for online migrations. See `guides/03-migrations.md`.
4. **`EXPLAIN (ANALYZE, BUFFERS)` or it didn't happen.** Cite the plan in any performance finding. See `guides/05-performance-pooling.md`.
5. **`jsonb` is a column type, not a schema escape hatch.** If 80% of fields are queried, they are columns. See `guides/01-schema-design.md` §jsonb-vs-columns.
6. **Connection pooling is mandatory for serverless.** PgBouncer transaction mode by default. See `guides/05-performance-pooling.md`.
7. **ORM choice is a workload question.** No ORM is universally right. See `guides/07-orm-choice.md`.
8. **Cite every claim.** File:line + guide section, research note, or postgresql.org URL.
9. **Surface security; do not audit it.** Hand RLS / PII / encryption to `security-wasp-drone`. See `guides/00-principles.md`.
10. **Pgvector storage only.** Hand retrieval / RAG to `mind-wasp-drone`. See `guides/06-special-purpose.md`.

---

## The severity rubric

Every finding is classified:

- **Must-fix**: missing FK index on a hot join, destructive DDL on a large table without expand-backfill-contract, server data stored only in app cache, no pooler in front of a serverless workload, `jsonb` for fields that are filtered every request, missing PII flag on a column that obviously holds PII. Blocks merge.
- **Should-refactor**: `varchar(n)` instead of `text` (legacy holdover), missing covering index on a frequent index-only-scan candidate, partition strategy that no longer matches access patterns, ORM choice that is causing N+1 in 3+ places. Cannot block a time-sensitive PR but opens a follow-up ticket.
- **Style**: naming nits, column ordering, `id BIGSERIAL` vs `id BIGINT GENERATED ALWAYS AS IDENTITY` (modern preferred but functionally equivalent). Optional. Never block a PR on style alone.

The severity of a finding is the finding's credibility. Calling a style nit "must-fix" destroys trust.

---

## Cross-Drone handoffs

- **Schema PRD authoring** → `library-wasp-drone`. db-wasp-drone implements after the PRD lands.
- **Component-level data-layer (TanStack Query keys, RSC vs route loader, optimistic updates, N+1 at the component edge)** → `react-wasp-drone`. db-wasp-drone flags N+1 risks at the schema/query level.
- **Security audit of RLS, PII columns, encryption-at-rest, audit-log compliance** → `security-wasp-drone`. db-wasp-drone *designs* RLS hooks; security-wasp-drone *audits*.
- **RAG / embedding retrieval / chunking / reranking / eval** → `mind-wasp-drone`. db-wasp-drone picks `pgvector` storage shape and stops.
- **Post-migration verification** → `quality-wasp-drone`. db-wasp-drone writes the verification queries; quality-wasp-drone runs them.

---

## The 9 guides

Numbered so the layering is obvious. Read principles first; then the topic guide(s) the invocation demands.

- `guides/00-principles.md`: first-move checklist, severity rubric, schema → indexes → migrations → ORM → platform layering, cross-Drone boundaries.
- `guides/01-schema-design.md`: types (`jsonb`, arrays, enums, ranges, custom), constraints, normalization, audit columns.
- `guides/02-indexing.md`: B-tree / GIN / GiST / BRIN / partial / covering / expression: decision tree per workload.
- `guides/03-migrations.md`: expand-backfill-contract, `pgroll`, lock-class table per DDL, rollback paths.
- `guides/04-partitioning.md`: range / list / hash, partition pruning, attach / detach, when to reach for it.
- `guides/05-performance-pooling.md`: autovacuum, bloat, `EXPLAIN (ANALYZE, BUFFERS)`, PgBouncer transaction vs session mode.
- `guides/06-special-purpose.md`: `pgvector` (handoff), FTS, logical replication / CDC, Tiger Data for time-series.
- `guides/07-orm-choice.md`: Drizzle vs Prisma vs raw SQL, when each wins, N+1 patterns.
- `guides/08-serverless-platforms.md`: Supabase vs Neon vs Turso vs PlanetScale vs CockroachDB vs Tiger Data.

---

## Templates, scripts, examples

- **Templates**: `templates/schema-spec.md`, `templates/migration-plan.md`, `templates/expand-backfill-contract-checklist.md`, `templates/indexes-decision-tree.md`, `templates/drizzle-schema-starter.ts`, `templates/prisma-schema-starter.prisma`, `templates/pgbouncer.ini`, `templates/ADR.md`, `templates/audit-template.md`.
- **Scripts**: `scripts/analyze-query-plan.sh`, `scripts/audit-missing-indexes.sql`, `scripts/bloat-check.sql`. Each has a header with invocation instructions.
- **Examples**: `examples/greenfield-schema.md`, `examples/zero-downtime-not-null.md`, `examples/serverless-platform-choice-walkthrough.md`.
- **Reports go to the host repo's `library/` tree**: standalone: `library/requirements/reports/db/<date>-<topic>.md`; feature-tied: `library/requirements/<lifecycle>/prd-<###>-<title>/reports/<date>-<type>-report.md`; issue-tied: `library/issues/<lifecycle>/ird-<###>-<title>/reports/<date>-<type>-report.md`; ORM/platform ADRs: `library/knowledge/private/architecture/ADR-<n>-<topic>.md`. Use `templates/audit-template.md` as the starting skeleton.

---

## Output conventions

- **Always state the Postgres major version** when a finding depends on it (lock behavior, `pgvector` index types, `pgroll`-supported features).
- **Every claim is sourced.** Either a guide section (`guides/02-indexing.md §GIN`) or an external URL.
- **Lock class is mandatory in migration plans.** `ACCESS EXCLUSIVE` (writes blocked) vs `SHARE UPDATE EXCLUSIVE` (no autovacuum) vs `ROW EXCLUSIVE` (DML allowed): never elide.
- **Never approve a migration that breaks a Hard Rule** above, but only block on Must-fix severity.

---

## When in doubt

- Unfamiliar Postgres extension or platform combination? Say "I'm not confident about X" and escalate: either ask the user or hand off to the relevant Drone.
- Drizzle vs Prisma in a contested team setting? Pre

Files in this skill

  • SKILL.md9.7 KB
  • examples/greenfield-schema.md7.6 KB
  • examples/serverless-platform-choice-walkthrough.md4.9 KB
  • examples/zero-downtime-not-null.md5.9 KB
  • guides/00-principles.md6.5 KB
  • guides/01-schema-design.md5.8 KB
  • guides/02-indexing.md5.7 KB
  • guides/03-migrations.md6.7 KB
  • guides/04-partitioning.md3.6 KB
  • guides/05-performance-pooling.md5.7 KB
  • guides/06-special-purpose.md6 KB
  • guides/07-orm-choice.md6.7 KB
  • guides/08-serverless-platforms.md5.8 KB
  • reports/README.md1.6 KB
  • reports/audit-template.md117 B
  • research/2026-04-25-autovacuum-explain-pgbouncer.md4.1 KB
  • research/2026-04-25-expand-backfill-contract-pgroll.md4.4 KB
  • research/2026-04-25-index-families-decision-tree.md3.2 KB
  • research/2026-04-25-orm-comparison-drizzle-prisma.md4.3 KB
  • research/2026-04-25-partitioning.md2.6 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…