Agentic SQL — Data skill for Claude Code

agentic-sql

Claude Code skill for **library-first SQL investigations**. Curated read-only query library + SQL gate (read-only role, single-statement SQLGlot allow-list, LIMIT injection) + a forced post-investigation curation step that keeps the library from rotting.

Works with any Postgres, any framework, any backend that you investigate via psql.

Based on:

• Vanna AI's saved-query RAG pattern
• AutoLink (arxiv 2511.17190) and LinkAlign (arxiv 2503.18596) — schema-as-retrieval
• LangChain SQL Toolkit's two-tier safety layer (LLM checker + AST gate)
• SQLGlot AST primer
• Cemri et al. (arxiv 2503.13657) — multi-agent failure modes (specifically "diffusion of responsibility" → why curation must be a workflow step, not "everyone's job")

Why this exists

Every team with a Postgres production database has the same problem: AI agents (and humans) keep re-deriving the same queries. A support ticket lands, someone reaches for psql, writes a query, runs it, reports back, and the query dies in a terminal history file. The next ticket reaches for the same query and re-derives it from scratch — sometimes with a different join key, sometimes missing a known gotcha, sometimes touching a column that was renamed three months ago.

Curated SQL libraries solve this — they're standard practice in mature data orgs — but they only work if the agent CONSULTS the library before writing new SQL and CURATES new findings after the investigation succeeds. Without enforcement, both steps get skipped under time pressure. The library freezes; ad-hoc scripts pile up in `scripts/audit_*.py`; the next incident the team can't find the query they wrote three months ago.

This skill makes both steps a non-negotiable part of the workflow: `find` before writing, `curate` before reporting back. Plus an SQL gate that prevents the most common production accidents (running a query as the app role, executing a hallucinated DELETE, returning millions of rows by mistake).

First-Time Se