Skills dbcraft

📦

dbcraft

Name: dbcraft
Author: laozhu001

Content revision r1 High Risk ⚙️ External commands🔑 Env variables🌐 Network access

Design Database Schemas With DB Craft

Database schema design can become fragmented across notes, SQL drafts, and diagrams. DB Craft opens a local visual studio to model tables, validate structure, and export SQL.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "dbcraft" from https://skillstore.io/skills/laozhu001-dbcraft.md and its manifest at https://skillstore.io/api/skills/laozhu001-dbcraft/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/laozhu001-dbcraft.md Signed manifest GET /api/skills/laozhu001-dbcraft/manifest Signed lockfile GET /api/skills/laozhu001-dbcraft/lockfile

Test it

Using "dbcraft". Create a PostgreSQL booking model.

Expected outcome:

DB Craft opens the local studio, creates a booking model, adds core tables, validates the structure, and prepares exportable SQL.

Using "dbcraft". Import my customer table definitions.

Expected outcome:

The skill imports the definitions into the current model, arranges the diagram, flags structure issues, and keeps the workspace model updated.

Using "dbcraft". Prepare this schema for migration review.

Expected outcome:

DB Craft saves the visual model, exports SQL, and creates a clear handoff for a separate migration or deployment workflow.

Security Audit

High Risk

v4 • 7/5/2026 Open versioned report

Most static hits are false positives from Markdown code spans, loopback URLs, local model filenames, and safety guidance. Confirmed risks remain: the skill can start a local DB Craft service through PowerShell and Node, and AI generation can use OPENAI_API_KEY. I found no prompt injection language or evidence of intentional data exfiltration.

Files scanned

843

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:34-35 scripts/launch-dbdesigner.ps1:57

External Application Directory Execution

The skill treats D:\DBdesigner as the source app directory and runs server.js from that location. This executes code outside the skill package, so users must trust a separate local application install.

SKILL.md directs agents to use D:\DBdesigner, and the launcher starts node server.js from that path. The execution target is not contained in the skill package.

Medium

scripts/launch-dbdesigner.ps1:57

Network reconnaissance

$startedProcess = Start-Process -FilePath $node.Source -ArgumentList @("server.js") -WorkingDirector

The line starts node server.js from the local DBdesigner directory. It is not reconnaissance, but it is real process launch behavior from a skill-controlled script.

Capability review items (10)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/install-prerequisites.md:6

PowerShell invocation

- The skill assumes a local DB Craft app can be started from a Windows environment with PowerShell s

This documents that the skill starts a local DB Craft app through PowerShell. That is real external command behavior and requires user trust in the launcher and local app.

High

references/install-prerequisites.md:12

PowerShell invocation

- PowerShell must be available because the current launcher uses `launch-dbdesigner.ps1`.

PowerShell is a required runtime because the skill uses launch-dbdesigner.ps1. Running PowerShell scripts from a marketplace skill is a real command execution surface.

High

references/install-prerequisites.md:48

Generic API/secret keys

- AI table generation does not require a server-side `OPENAI_API_KEY` if the user configures a model

The documentation discusses a server-side OPENAI_API_KEY path for AI generation. Even if optional, this confirms that the app may rely on secret-bearing environment configuration.

High

references/usage.md:87

Generic API/secret keys

- Fallback key source: server env var `OPENAI_API_KEY`

The usage guide names OPENAI_API_KEY as a fallback key source. Reading API keys from the server environment is a real credential handling risk.

High

SKILL.md:35

Ruby/shell backtick execution

- Start the app with `node server.js` in that directory. Use the bundled PowerShell launcher for rel

The skill instructs the agent to start the app with node server.js and use the PowerShell launcher. This is real external process execution.

High

SKILL.md:35

PowerShell invocation

- Start the app with `node server.js` in that directory. Use the bundled PowerShell launcher for rel

The skill explicitly directs use of a PowerShell launcher to start DB Craft. That creates a real script execution surface for a marketplace skill.

High

SKILL.md:42

PowerShell invocation

- The PowerShell launcher defaults `WorkspacePath` to the current shell directory so DB Craft opens

The line describes launcher behavior that passes the current workspace path to DB Craft. It confirms PowerShell launcher use and local workspace exposure to the launched app.

High

SKILL.md:25

Generic API/secret keys

4. If the user needs AI table generation, confirm `OPENAI_API_KEY` is available in the current envir

The skill tells the agent to confirm whether OPENAI_API_KEY is available. Checking a secret-bearing environment variable is legitimate for AI use but remains sensitive.

High

SKILL.md:79

Generic API/secret keys

- Prefer the API key saved in `Settings -> AI Config`; fall back to the server environment variable

The skill states that DB Craft falls back to the server environment variable OPENAI_API_KEY. This is direct credential handling and should require careful disclosure and logging controls.

Medium

SKILL.md:21

Ruby/shell backtick execution

- If it is not up, run `scripts/launch-dbdesigner.ps1` to start the local server, then tell the user

The Markdown backticks are not Ruby execution, but the instruction tells the agent to run scripts/launch-dbdesigner.ps1. That is real external command execution.

Risk Factors

⚙️ External commands (37)

🔑 Env variables (4)

references/install-prerequisites.md:48 references/usage.md:87 SKILL.md:25 SKILL.md:79

🌐 Network access (10)

scripts/launch-dbdesigner.ps1:36 scripts/launch-dbdesigner.ps1:3 SKILL.md:19 SKILL.md:23 SKILL.md:37 SKILL.md:45 SKILL.md:19 SKILL.md:23 SKILL.md:37 SKILL.md:45

Detected Patterns

Network reconnaissance

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/laozhu001-dbcraft/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/laozhu001-dbcraft/security.svg)](https://skillstore.io/skills/laozhu001-dbcraft?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/laozhu001-dbcraft?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/laozhu001-dbcraft/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/laozhu001-dbcraft.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

laozhu001. (2026). dbcraft security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/laozhu001-dbcraft/audits/4

BibTeX citation

@techreport{laozhu001-laozhu001-dbcraft-2026,
  author = {laozhu001},
  title = {dbcraft security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/laozhu001-dbcraft/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dbcraft security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "laozhu001"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/laozhu001-dbcraft/audits/4"
identifiers:
  - type: other
    value: "skillstore:laozhu001-dbcraft:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Plan New Service Tables

Create a visual model for a new service, validate table structure, and export SQL for implementation review.

Convert Requirements Into Models

Turn product requirements or screenshots into tables that align frontend data needs with backend storage.

Review Schema Handoffs

Inspect relationships, generated tables, and exported SQL before a separate migration workflow applies changes.

Try These Prompts

Open A New Model

Open DB Craft and create a MySQL 8 model for a student management system. Add student, class, and teacher tables.

Import Existing SQL

Open DB Craft and import my existing table definitions into the current workspace model. Validate the structure and organize the diagram.

Generate Tables With AI

Use DB Craft AI to design tables for an e-commerce cart, order, and payment workflow. Save the model in the active workspace.

Prepare Migration Handoff

Continue from the current DB Craft handoff, update the model with the requested changes, validate it, export SQL, and summarize deployment notes.

Best Practices

Keep each project model saved in the active workspace directory.
Review generated SQL before using it in a real database workflow.
Use personal API keys carefully and hide secrets from screenshots.

Avoid

Treating DB Craft output as an automatic production database change.
Starting duplicate local services before checking the existing service.
Placing secrets in schema comments, AI prompts, or public screenshots.

Frequently Asked Questions

What is DB Craft?

DB Craft is a local visual studio for designing database schemas and exporting SQL.

Which databases are supported?

It supports MySQL 8, PostgreSQL 14, SQLite, and MSSQL model workflows.

Does it change a live database?

No. The public skill stops at model, SQL export, and handoff by default.

Is DB Craft a cloud service?

No. It opens a local app and writes model artifacts into the active workspace.

Can AI generation send data outside my machine?

Yes. AI Build may send prompts to the model provider configured by the user.

What local requirements are needed?

The current package needs Windows, Node.js, PowerShell, a browser, and the local DB Craft app files.

Developer Details

Author

laozhu001

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/laozhu001/dbcraft/tree/dev-laozhu/skill

Ref

a25199bc7d6b82598536822d1738eb5d5f54025b

Maintenance freshness

7/18/2026

Usage

7 downloads · 121 views

File structure

📁 agents/

📄 openai.yaml

📁 references/

📄 data-security.md

📄 example-prompts.md

📄 icon-and-screenshot-checklist.md

📄 install-prerequisites.md

📄 marketplace-copy.md

📄 marketplace-submission-checklist.md

📄 usage.md

📁 scripts/

📄 launch-dbdesigner.ps1

📄 SKILL.md