agent-skillsCAUTION
AI agent skill repo
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Experimental / WIP — This repo is under active development. Skills and APIs may change.
A collection of Claude Code agent skills purpose-built for YugabyteDB. Each skill encodes deep domain knowledge so Claude can give accurate, production-ready guidance without guessing.
Skills
yugabytedb-app-dev
Build production-grade applications that connect to YugabyteDB across any language runtime or framework.
Covers: JDBC/Spring Boot, Spring WebFlux + R2DBC, Quarkus (SmallRye + Agroal), Python, Node.js, Go, .NET — with correct driver config, HikariCP/Agroal/Npgsql pool tuning, transaction retry logic (SQL states 40001, 40P01, 57P01), Flyway migrations, and topology-aware load balancing.
Triggers on: "connect my app to YugabyteDB", "YugabyteDB Spring Boot", "YugabyteDB retry", serialization failure errors, connection pool setup.
yugabytedb-schema-design
Design high-performance schemas for YugabyteDB from scratch or optimize existing ones.
Covers: Hash vs range sharding decisions, avoiding write hotspots on sequential/timestamp columns, partial indexes for NULL-heavy and skewed columns, low-cardinality index design, covering indexes, primary key selection, foreign key index requirements, and redundant index cleanup.
Triggers on: "design a YugabyteDB schema", "sharding key", "tablet hotspot", "YSQL indexes", slow or skewed writes.
yugabytedb-sizing
Calculate optimal YugabyteDB cluster sizing from workload inputs, producing a complete hardware recommendation targeting ≤65% CPU utilization.
Covers: CPU sizing with Raft/RPC overhead, storage with LZ4 compression + WAL + compaction reserve, memory per connection, IOPS estimation, network bandwidth, 1–2 year storage growth projections, failure resilience under node/zone loss, CDC and xCluster overhead.
Triggers on:
56b29b417facOBSERVED · 2026-10-13Install
Commands as the repository documents them. They are shown, not run.
pip install psycopg2-binary # or asyncpg for async
npm install @yugabytedb/pg # YugabyteDB smart driver (fork of node-postgres)
npm install @yugabytedb/pg # YugabyteDB smart driver (fork of node-postgres)
pip install psycopg2-binary # sync
pip install asyncpg # async (FastAPI, etc.)
pip install sqlalchemy # ORM (works with both drivers)
Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned | |
| cursor | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: yugabytedb-app-dev description: > Build production-grade applications that connect to YugabyteDB across any language runtime or framework. Covers JDBC/Spring Boot, Spring Boot Reactive (WebFlux + R2DBC), Quarkus (SmallRye Fault Tolerance + Agroal), Python, Node.js, Go, .NET, and more — with correct driver config, pool tuning (HikariCP/Agroal/Npgsql), transaction retry logic, Flyway migrations, and topology-aware load balancing. Use this skill whenever the user is writing NEW application code that talks to YugabyteDB, integrating a framework (Spring, Quarkus, Micronaut, FastAPI, Express, etc.) with YugabyteDB, asking how to handle transaction retries or serialization errors with YugabyteDB, configuring a connection pool for YugabyteDB, Trigger even when the user just says "connect my app to YugabyteDB" or "YugabyteDB Spring Boot" or "YugabyteDB retry". --- # YugabyteDB Application Development Skill A reference skill for building applications on top of YugabyteDB, covering connection config, transaction retries, and language/framework-specific best practices. --- ## Overview YugabyteDB is a distributed SQL database compatible with PostgreSQL. Writing applications for it requires attention to three areas standard Postgres apps often skip: 1. **Driver** — Use the YugabyteDB JDBC driver (`jdbc-yugabytedb`) or the standard Postgres driver. YB's driver adds cluster-aware load balancing and topology routing. 2. **Retries** — Distributed transactions can fail with transient errors (serialization failures `40001`, deadlocks `40P01`, connection resets). Applications MUST retry these rather than surface them to users. --- ## Quick Reference by Runtime | Runtime | Driver / Library | Retry Mechanism | |---|---|---| | Java / Spring Boot | `jdbc-yugabytedb` + HikariCP | Spring core `RetryPolicy` + `ExponentialBackOff` (built-in, no extra dep) + AOP aspect | | Java / Spring Boot Reactive | `r2dbc-postgresql` + r2dbc-pool | Reactor `.retryWhen(YbRetry.spec())` inline in pipeline | | Java / Quarkus | `jdbc-yugabytedb` + Agroal | SmallRye `@Retry` + CDI interceptor for exception translation | | Python | `psycopg2` / `asyncpg` | Custom decorator wrapping `psycopg2.errors.SerializationFailure` | Two connection pools | | Node.js | `@yugabytedb/pg` (smart driver) | `withRetry` loop catching `40001`/`40P01`/`XX000` | `EndpointPoolManager` (multi-endpoint probe + failover) | | Go | `pgx` | `pgx` retry loop | Two `pgxpool.Pool` instances | | .NET / ASP.NET Core | `Npgsql` + EF Core | Polly `AsyncRetryPolicy` | Two `DbContext` registrations (rw + ro) | --- ## Instructions - Use the latest stable version of the YugabyteDB driver for your language - Use the latest stable version of the application framework for your language --- ## Core Concepts ### Transaction Error Codes to Retry ``` 40001 — serialization_failure (optimistic concurrency) 40P01 — deadlock_detected 57P01 — admin_shutdown (node restart / kill -15) 08006 — connection_failure (socket timeout, kill -9) XX000 — internal_error — ONLY retry conditionally ``` Also retry on these Java exception types for JPA/JDBC: - `SQLRecoverableException` - `SQLTransientConnectionException` - `TransientDataAccessException` - Hibernate `TransactionException` (begin/commit/rollback failures) --- ## Java References ### Spring Boot For full details read → [`references/java-spring.md`](references/java-spring.md) Key files in the reference implementation: | File | Purpose | |---|---| | `KVRetryPolicy.java` | Implements `RetryPolicy` — classifies retryable exceptions; owns `ExponentialBackOff` | | `DataSourceAspect.java` | AOP aspect wrapping all `@Service` methods with `RetryTemplate` | | `YbDataApplication.java` | Wires `RetryTemplate` with exponential backoff from config | | `KVService.java` | Service using `@Transactional` and `@Transactional(readOnly = true)` | | `application.yaml` | Full driver + pool + retry config | ### Spring Boot Reactive (WebFlux + R2DBC) For full details read → [`references/java-spring-reactive.md`](references/java-spring-reactive.md) Key differences from Spring Boot (blocking): | Topic | Reactive behaviour | |---|---| | Driver | `com.yugabyte:r2dbc-postgresql` (YugabyteDB fork) — URL scheme `r2dbc:postgresql://` | | Retry | `RetryConfigSpec` bean provides `Retry`; controller applies `.retryWhen(retrySpec)` on each pipeline | | Transactions | `@Transactional` in service; retry wraps outside via controller pipeline | | Migrations | Flyway still runs over JDBC at startup (add `jdbc-yugabytedb` as a side-car dep) | ### Quarkus For full details read → [`references/java-quarkus.md`](references/java-quarkus.md) Key differences from Spring Boot: | Topic | Quarkus behaviour | |---|---| | Connection pool | Agroal (not HikariCP); config via `quarkus.datasource.jdbc.*` | | Retry mechanism | SmallRye Fault Tolerance `@Retry` + custom CDI interceptor for SQL-state translation | | **Interceptor ordering** | **CRITICAL**: set `mp.fault.tolerance.interceptor.priority=100` so `@Retry` wraps outside `@Transactional`, giving each retry a fresh transaction | | Native image | YugabyteDB driver is JVM-mode only — not compatible with GraalVM native compilation | --- ## Python Reference For full details read → [`references/python.md`](references/python.md) --- ## Node.js Reference For full details read → [`references/nodejs.md`](references/nodejs.md) --- ## Go Reference For full details read → [`references/go.md`](references/go.md) --- ## .NET Reference For full details read → [`references/dotnet.md`](references/dotnet.md) --- ## Step-by-Step: New Application Setup ### 1. Add Dependencies **Maven (Java):** ```xml <dependency> <groupId>com.yugabyte</groupId> <artifactId>jdbc-yugabytedb</artifactId> <version>42.7.3-yb-4</version> </dependency> <dependency> <groupId>org.springframework.retry</groupId> <artifactId>spring-retry</artifactId> <version>2.0.12</version> </dependency> ``` **
Trust audit
CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (5)
"postgresql://yugabyte:[email protected]:5433/yugabyte" +
DSN = "postgresql://yugabyte:[email protected]:5433/yugabyte?load_balance=true"
dsn="postgresql://yugabyte:[email protected]:5433/yugabyte"
dsn="postgresql://yugabyte:[email protected]:5433/yugabyte",
Gates applied: no_behavioural_pass, no_license.
56b29b417facfull audit observations/trust-audit/skill/srinivasa-vasu__agent-skills.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | 56b29b417fac | CAUTION | C | 79 | first audit |
Questions
What does the agent-skills skill do?
AI agent skill repo
Is agent-skills safe to install?
With care. The audit graded it C (79/100) and found 5 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can agent-skills access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: found — see the findings.
Which assistants does agent-skills work with?
Its documentation mentions claude-code and cursor. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (56b29b417fac), read on 2026-10-13. The repository is watched, and a new audit runs when it changes — this is the first audit.