skills/db-migrate/SKILL.md
Create, validate, and manage database migrations across any framework. Auto-detects Alembic, Prisma, Knex, Django, Flyway, Rails, and more.
npx skillsauth add mgiovani/cc-arsenal db-migrateInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Cross-Platform AI Agent Skill This skill works with any AI agent platform that supports the skills.sh standard.
Create, validate, and run database migrations across any framework. Auto-detects the migration tool from project files.
CRITICAL: Migration operations can be irreversible in production:
--dry-run mode when supported by the frameworkScan for marker files to identify the migration framework:
# Check for common marker files
ls alembic.ini 2>/dev/null
ls prisma/schema.prisma 2>/dev/null
ls knexfile.* 2>/dev/null
ls flyway.conf 2>/dev/null
ls db/migrate/ 2>/dev/null
ls manage.py 2>/dev/null
ls atlas.hcl 2>/dev/null
Also check:
package.json for knex, db-migrate, sequelize, typeorm dependenciespyproject.toml / requirements.txt for alembic, sqlalchemyGemfile for activerecordIf multiple frameworks detected, ask user which one to use. If none detected, ask user to specify.
Refer to references/framework-commands.md for the full detection table and per-framework commands.
Determine operation mode from $ARGUMENTS:
create (or no argument): Create a new migration filestatus: Show pending and applied migrationsvalidate: Check rollback scripts, naming conventions, index coverageIf --name <name> provided, use it for migration name. Otherwise ask for a descriptive name.
If --dry-run provided, show what would be created/run without executing.
migrations/, db/migrate/) — infer patterndate +%Y%m%d%H%M%SAfter creation, remind user to:
Run the framework's status command and display:
Check the following:
up migration has a down script (warn if missing)REFERENCES or foreign key declarations without corresponding CREATE INDEXDROP TABLE, DROP COLUMN, TRUNCATE — flag each oneAlways run these before finalizing a create operation:
Destructive operation detection:
grep -iE "DROP TABLE|DROP COLUMN|TRUNCATE|DELETE FROM" <migration_file>
If found: warn user, require explicit confirmation to proceed.
Missing index check:
grep -iE "REFERENCES|foreign_key|FK_" <migration_file>
If foreign keys present, check for corresponding index creation.
Rollback verification:
Display a summary of what was created or checked:
<command>, rollback with <command>)create: Create a new migration (default if no subcommand given)status: Show migration statusvalidate: Validate existing migrations--name <name>: Migration description for the filename--dry-run: Show what would happen without executingDATABASE_URL is not production# Create a new migration
/db-migrate create --name add_users_table
# Check pending migrations
/db-migrate status
# Validate migration quality
/db-migrate validate
# Create without executing (preview)
/db-migrate create --name drop_legacy_column --dry-run
development
Generate comprehensive test suites with coverage analysis and parallel test writing. Automatically activates when users want to write tests, add test coverage, generate test cases, improve testing, or analyze coverage gaps. Supports pytest, vitest, jest, and all major test frameworks.
development
Multi-agent PR review team orchestration with 7 specialized reviewers for security-sensitive or architectural PRs. Spawns architecture, security, performance, testing, style, docs/UX, and adversary reviewers as a coordinated team. Premium review for critical code changes.
development
Spec-driven team orchestration: adaptive development team scaling from 3 to 11 agents based on complexity.
development
Perform comprehensive security review targeting OWASP Top 10 2025 vulnerabilities for PRs, commits, or entire codebases. This skill should be used when a user wants to audit code security, scan for vulnerabilities, review security posture, or check for OWASP compliance. Analysis only - identifies vulnerabilities without modifying code.