sql-code-review

Name: sql-code-review
Author: totvs

108stars50forks

How to install sql-code-review?

totvs/engpro-advpl-tlpp-skills/sql-code-review

$npx -y skills add totvs/engpro-advpl-tlpp-skills --skill sql-code-review

Installs into the current project.

Summary

Universal SQL code review assistant that performs comprehensive security, maintainability, and code quality analysis across SQL databases (PostgreSQL, SQL Server, Oracle). Focuses on SQL injection prevention, access control, code standards, and anti-pattern detection. Complements

Files · 1

View on GitHub

SKILL.md

1	# SQL Code Review
2
3	Perform a thorough SQL code review of ${selection} (or entire project if no selection) focusing on security, performance, maintainability, and database best practices.
4
5	## Review Categories
6
7	### 🔒 Security
8
9	- SQL Injection Prevention — all user inputs must be parameterized; no string concatenation in queries
10	- Access Control — principle of least privilege, role-based permissions, schema security
11	- Data Protection — avoid `SELECT *` on sensitive tables, enforce audit logging and data masking
12
13	### ⚡ Performance
14
15	- Query Structure — eliminate `SELECT DISTINCT *`, prefer explicit JOINs over comma-separated FROM
16	- Index Strategy — verify indexes for WHERE/JOIN columns, flag over-indexing and unused indexes
17	- Join Optimization — correct join types, optimal join order, no accidental Cartesian products
18	- Aggregation — replace correlated subqueries with JOIN/GROUP BY when possible
19
20	### 🛠️ Code Quality
21
22	- Formatting — consistent uppercase keywords, aligned columns, proper indentation
23	- Naming — descriptive table/column names, no reserved words as identifiers, consistent casing
24	- Schema Design — appropriate normalization, optimal data types, proper constraints and defaults
25
26	### 🗄️ Database Compatibility
27
28	- ANSI SQL first — use COALESCE, CASE WHEN, ANSI JOINs, FETCH FIRST for portability
29	- Database-specific idioms — leverage engine-specific features (JSONB, COLUMNSTORE, sequences) where appropriate
30
31	> Protheus note: Use `ChangeQuery()` to automatically translate SQL syntax to the active database dialect. BeginSQL/EndSQL calls `ChangeQuery()` automatically.
32
33	---
34
35	## Bundled Reference Files
36
37	This skill uses progressive disclosure. The SKILL.md body covers the review workflow, category definitions, checklist, and output format. Detailed code examples, anti-patterns, and database-specific best practices are in the `references/` directory — read them on demand based on the scenario:
38
39	\| Reference File \| When to Read \| Content \|
40	\| --- \| --- \| --- \|
41	\| [references/sql-security-patterns.md](references/sql-security-patterns.md) \| Reviewing security concerns — SQL injection, access control, data protection, or dynamic SQL \| Injection examples, parameterization patterns, access control checklist, data masking examples \|
42	\| [references/sql-performance-and-quality-patterns.md](references/sql-performance-and-quality-patterns.md) \| Reviewing query performance, code style, anti-patterns, or testing strategies \| Query optimization examples, JOIN/aggregation patterns, N+1 and DISTINCT anti-patterns, formatting standards, data integrity checks \|
43	\| [references/database-specific-best-practices.md](references/database-specific-best-practices.md) \| Reviewing SQL targeting a specific database (PostgreSQL, SQL Server, Oracle) or cross-database portability \| ANSI SQL cross-database patterns, PostgreSQL (JSONB, GIN), SQL Server (NVARCHAR, COLUMNSTORE), Oracle (sequences, VARCHAR2) \|
44
45	> Also refer to [references/sonarqube-rules-reference.md](../references/sonarqube-rules-reference.md) for the complete SonarQube rules reference shared across skills.
46
47	---
48
49	## Review Workflow
50
51	### Step 1: Identify Scope and Database
52
53	Determine from the user's request:
54
55	- Which SQL files or queries to review
56	- Target database engine (PostgreSQL, SQL Server, Oracle, or multi-database)
57	- Review focus (security, performance, quality, or full review)
58
59	### Step 2: Load Relevant References
60
61	Based on the review focus and database, read the appropriate reference files:
62
63	- Security focus → read [references/sql-security-patterns.md](references/sql-security-patterns.md)
64	- Performance / quality focus → read [references/sql-performance-and-quality-patterns.md](references/sql-performance-and-quality-patterns.md)
65	- Database-specific review → read [references/database-specific-best-practices.md](references/database-specific-best-practices.md)
66	- Full review → read all three reference files
67
68	### Step 3: Analyze Code Against Checklist
69
70	Walk through each category in the checklist below. For each finding, classify priority as CRITICAL, HIGH, MEDIUM, or LOW.
71
72	### Step 4: Generate Report
73
74	Use the Issue Template (below) for each finding. Group findings by category and sort by priority.
75
76	---
77
78	## SQL Review Checklist
79
80	### Security
81	- [ ] All user

People who liked this also viewed

6 picks

Type

sql-code-review

108stars50forks

View on GitHub

How to install sql-code-review?

totvs/engpro-advpl-tlpp-skills/sql-code-review

$npx -y skills add totvs/engpro-advpl-tlpp-skills --skill sql-code-review

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SQL Code Review
2
3	Perform a thorough SQL code review of ${selection} (or entire project if no selection) focusing on security, performance, maintainability, and database best practices.
4
5	## Review Categories
6
7	### 🔒 Security
8
9	- SQL Injection Prevention — all user inputs must be parameterized; no string concatenation in queries
10	- Access Control — principle of least privilege, role-based permissions, schema security
11	- Data Protection — avoid `SELECT *` on sensitive tables, enforce audit logging and data masking
12
13	### ⚡ Performance
14
15	- Query Structure — eliminate `SELECT DISTINCT *`, prefer explicit JOINs over comma-separated FROM
16	- Index Strategy — verify indexes for WHERE/JOIN columns, flag over-indexing and unused indexes
17	- Join Optimization — correct join types, optimal join order, no accidental Cartesian products
18	- Aggregation — replace correlated subqueries with JOIN/GROUP BY when possible
19
20	### 🛠️ Code Quality
21
22	- Formatting — consistent uppercase keywords, aligned columns, proper indentation
23	- Naming — descriptive table/column names, no reserved words as identifiers, consistent casing
24	- Schema Design — appropriate normalization, optimal data types, proper constraints and defaults
25
26	### 🗄️ Database Compatibility
27
28	- ANSI SQL first — use COALESCE, CASE WHEN, ANSI JOINs, FETCH FIRST for portability
29	- Database-specific idioms — leverage engine-specific features (JSONB, COLUMNSTORE, sequences) where appropriate
30
31	> Protheus note: Use `ChangeQuery()` to automatically translate SQL syntax to the active database dialect. BeginSQL/EndSQL calls `ChangeQuery()` automatically.
32
33	---
34
35	## Bundled Reference Files
36
37	This skill uses progressive disclosure. The SKILL.md body covers the review workflow, category definitions, checklist, and output format. Detailed code examples, anti-patterns, and database-specific best practices are in the `references/` directory — read them on demand based on the scenario:
38
39	\| Reference File \| When to Read \| Content \|
40	\| --- \| --- \| --- \|
41	\| [references/sql-security-patterns.md](references/sql-security-patterns.md) \| Reviewing security concerns — SQL injection, access control, data protection, or dynamic SQL \| Injection examples, parameterization patterns, access control checklist, data masking examples \|
42	\| [references/sql-performance-and-quality-patterns.md](references/sql-performance-and-quality-patterns.md) \| Reviewing query performance, code style, anti-patterns, or testing strategies \| Query optimization examples, JOIN/aggregation patterns, N+1 and DISTINCT anti-patterns, formatting standards, data integrity checks \|
43	\| [references/database-specific-best-practices.md](references/database-specific-best-practices.md) \| Reviewing SQL targeting a specific database (PostgreSQL, SQL Server, Oracle) or cross-database portability \| ANSI SQL cross-database patterns, PostgreSQL (JSONB, GIN), SQL Server (NVARCHAR, COLUMNSTORE), Oracle (sequences, VARCHAR2) \|
44
45	> Also refer to [references/sonarqube-rules-reference.md](../references/sonarqube-rules-reference.md) for the complete SonarQube rules reference shared across skills.
46
47	---
48
49	## Review Workflow
50
51	### Step 1: Identify Scope and Database
52
53	Determine from the user's request:
54
55	- Which SQL files or queries to review
56	- Target database engine (PostgreSQL, SQL Server, Oracle, or multi-database)
57	- Review focus (security, performance, quality, or full review)
58
59	### Step 2: Load Relevant References
60
61	Based on the review focus and database, read the appropriate reference files:
62
63	- Security focus → read [references/sql-security-patterns.md](references/sql-security-patterns.md)
64	- Performance / quality focus → read [references/sql-performance-and-quality-patterns.md](references/sql-performance-and-quality-patterns.md)
65	- Database-specific review → read [references/database-specific-best-practices.md](references/database-specific-best-practices.md)
66	- Full review → read all three reference files
67
68	### Step 3: Analyze Code Against Checklist
69
70	Walk through each category in the checklist below. For each finding, classify priority as CRITICAL, HIGH, MEDIUM, or LOW.
71
72	### Step 4: Generate Report
73
74	Use the Issue Template (below) for each finding. Group findings by category and sort by priority.
75
76	---
77
78	## SQL Review Checklist
79
80	### Security
81	- [ ] All user

People who liked this also viewed

6 picks

Type