# Query Review

> Review an authorized codebase for ORM misuse, N+1 query patterns, authorization-after-fetch bugs, raw SQL risks, cache key collisions, and missing tenant scopes. Use for data-access layers and security-adjacent performance pitfalls.

- Skill: `muhammedzohaib/query-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add muhammedzohaib/query-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/muhammedzohaib/query-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: MuhammedZohaib (https://skillmd.com/u/muhammedzohaib)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/muhammedzohaib/query-review

---


# Query Review

## Focus

- missing tenant scopes
- authorization after broad fetches
- raw SQL without parameter binding
- N+1 patterns that become availability or side-channel issues
- eager loads that overexpose sensitive associations
- cache keys missing tenant or role context

## Heuristic

Treat data-access issues as security-relevant when they change scope, leak metadata, or undermine availability controls.