skills/team/sqlx-migration-manager/SKILL.md
SQLx migration lifecycle management with safety checks and rollback planning. Manages plain SQL migration files, compile-time query verification via sqlx prepare, and the offline query cache. Use when creating, reviewing, or applying database migrations in Rust/SQLx projects, managing sqlx migrate run/revert, regenerating the sqlx offline cache after schema changes, or planning zero-downtime migrations. Triggers on: "sqlx migration", "rust database migration", "create migration rust", "sqlx migrate", "sqlx schema change", "sqlx prepare", "sqlx offline cache".
npx skillsauth add michaelalber/ai-toolkit sqlx-migration-managerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"A migration that cannot be rolled back is a migration that has not been tested. SQLx's compile-time query verification is a gift — but only if you regenerate the cache after every migration."
SQLx migrations are plain SQL files — no ORM-generated DDL, no code-first schema. That is a
strength: the SQL is explicit, reviewable, and portable. But SQLx's compile-time query verification
(sqlx::query! macros) means schema changes can break compilation, so the offline query cache
(sqlx prepare) must be regenerated after every migration. This skill manages the full lifecycle
with the same safety philosophy as ef-migration-manager and alembic-migration-manager: never
apply a migration you have not reviewed, never apply without testing the rollback, and always
regenerate the offline cache after applying.
Non-Negotiable Constraints:
sqlx migrate run; never apply unreviewed SQL.sqlx migrate revert must work on a dev database before the migration is considered safe.sqlx prepare after every sqlx migrate run; commit .sqlx/. Skipping it breaks compilation for everyone.CREATE TABLE/INDEX IF NOT EXISTS, ADD COLUMN IF NOT EXISTS (PostgreSQL 9.6+).Full principle table, KB lookups, discipline rules, anti-patterns, and error recovery live in
references/conventions.md.
PLAN Identify the schema change; assess data-loss risk (DROP/TRUNCATE/type change) and
locking risk (table rewrites, index creation); plan the rollback SQL; decide whether
zero-downtime is required. (Per-operation detail: dangerous-operations.md.)
CREATE sqlx migrate add <descriptive-name>; write the forward SQL and the rollback SQL.
REVIEW (gate) Read the file completely: no unintended data loss, acceptable locking, correct
rollback SQL, idempotency where applicable. Do not proceed until reviewed.
TEST ROLLBACK On a dev database: sqlx migrate run → verify schema → sqlx migrate revert → verify
it returned to the previous state → sqlx migrate run again.
APPLY sqlx migrate run → sqlx migrate info (shows applied) → cargo build (no errors).
(Apply/rollback sequence + commands: migration-safety-checklist.md.)
REGENERATE sqlx prepare → verify SQLX_OFFLINE=true cargo build → commit .sqlx/ with the migration.
Exit criteria: migration reviewed, rollback tested, applied and verified (sqlx migrate info),
offline cache regenerated and committed, SQLX_OFFLINE=true cargo build passes.
<sqlx-migration-state>
phase: PLAN | CREATE | REVIEW | TEST_ROLLBACK | APPLY | REGENERATE_CACHE | COMPLETE
migration_name: [name]
database: postgresql | mysql | sqlite | unknown
migration_file: [path to .sql file]
sql_reviewed: true | false
rollback_tested: true | false
migration_applied: true | false
cache_regenerated: true | false
build_status: pass | fail | not-run
data_loss_risk: none | low | medium | high
locking_risk: none | low | medium | high
last_action: [description]
next_action: [description]
</sqlx-migration-state>
references/output-templates.md.references/dangerous-operations.md..sqlx/ management — references/migration-safety-checklist.md.references/conventions.md.| Skill | Relationship |
|-------|-------------|
| rust-feature-slice | When a feature needs database tables, this skill provides the migration lifecycle; the feature's service uses sqlx::query! against the migrated schema. |
| rust-architecture-checklist | Verifies sqlx::query! macros are used (not raw SQL strings) and the offline cache is committed. |
| rust-security-review | Checks for SQL injection via format!() in SQL contexts; this skill enforces parameterized queries. |
| ef-migration-manager | Parallel skill for .NET/EF Core — same safety philosophy, different tooling. |
| alembic-migration-manager | Parallel skill for Python/Alembic — same safety philosophy, different tooling. |
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".