db.execute(sql.raw(`SELECT * FROM orders ORDER BY ${req.query.sort}`)) sends the request's own text to the database as SQL, and a start script that runs drizzle-kit push --force accepts every data-loss statement on the production database without asking. This skill finds those and the other Drizzle mistakes below before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your drizzle.config files, schema files (pgTable, sqliteTable, mysqlTable, also through pgTableCreator, pgSchema or an alias), TypeScript and JavaScript query code, and package.json scripts. It skips comments and test files, follows request data from Express, Fastify, Koa, Hono, Next.js (route handlers, cookies, server actions), tRPC, Nuxt and SvelteKit through local variables and function parameters, treats the sql tagged template and the query builder as parameterized, accepts values picked from fixed choices or kept to them by a check that rejects anything else, and leaves local development credentials, example hosts and the placeholders of Drizzle's own docs alone. It never runs your code or connects to a database. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• D01: request data (including tRPC input, server action arguments and cookies) in sql.raw(), also inside a sql template or through JSON.stringify(), or in a plain SQL string given to db.execute(), db.run(), db.all(), db.get() or db.values()
• D02: database passwords and tokens written in a connection URL, dbCredentials, the connection object of drizzle() or a driver, a ?? or || fallback, or a package.json script (a URL, --password, --auth-token, PGPASSWORD=)
• D03: drizzle-kit push --force run by a start, build, deploy, release or install script, directly or through another npm script

REVIEW (check before release)

• D11: sql.raw() or a plain SQL string built from a parameter, stored data or another function's result
• D12: sql.identifier() with a table or column name from input
• D13: drizzle-kit push (without --force or --explain) run by a start, build, deploy, release or install script
• D14: money columns (price, amount, balance, total...) stored as real, double or float
• D15: password columns whose names do not say they hold a hash (Better Auth account tables are left alone)
• D16: foreign keys without an index on the referencing column in PostgreSQL, SQLite and SQL Server tables
• D17: db.delete(table) or db.update(table).set() with no where(), outside seed and reset scripts
• D18: drizzle-kit studio started with --host 0.0.0.0
• D19: database certificate checks turned off (rejectUnauthorized: false, trustServerCertificate: true, sslmode=no-verify, NODE_TLS_REJECT_UNAUTHORIZED=0, postgres.js ssl: 'require')

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official source for each rule
• A risky and a safe example project (drizzle.config.ts, schema, Express routes, package.json), and the real report the scanner produces on the risky one

Limits

It reads each file on its own and follows request data only through variables in that file: values passed in from helpers in other files are reported as D11, not D01, and scopes are read from brackets and declarations rather than a full parser. SQL migration files, .env files, Dockerfiles, CI workflows and .svelte, .vue or .astro files are not read, and it does not check your Drizzle version, database grants or row-level security policies. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 22 files: SKILL.md, the scanner in scripts/ (9 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (10 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.