subinium Audit Migration
Slash-command entry point for the migration-reviewer agent. The agent reads migrations and produces a severity-tagged report; this skill routes there with the right scope.
When this skill fires
- Direct call:
/audit-migrationor/audit-migration prisma/migrations/20260427_add_index/ - Before destructive ops: any time the user is about to run
prisma migrate deploy,supabase db push,sqlx migrate run, ordrizzle-kit push - Trigger phrases: "마이그레이션 리뷰", "DB 스키마 검토", "schema migration audit"
Process
Detect migration system if no path argument given:
prisma/migrations/→ Prismasupabase/migrations/→ Supabasemigrations/(with.sqlfiles) → Drizzle / sqlx / raw SQLdb/migrate/→ Rails/ActiveRecord
Identify scope — if a specific path is given, audit only that. Otherwise audit the most recent N=5 migrations (recent enough to be relevant, bounded so the report stays focused).
Spawn
migration-revieweragent with the path(s) and detected system. The agent is read-only — never applies migrations.Render the agent's report organized by severity:
- 🔴 Blocker: data loss without backup, missing rollback, irreversible without manual recovery
- 🟠 High: lock contention on a large table, NOT NULL on existing rows without default, dropping indexes without replacement
- 🟡 Medium: missing indexes for new foreign keys, type changes that require table rewrite
- 🔵 Low: naming conventions, missing comments, formatting
Refuse to apply. The user runs the migration tool themselves. This skill never executes
migrate deployordb push.
Output principle
Lead with the highest severity. If there are no Blockers or Highs, say "Safe to apply" in the first sentence — don't bury the verdict.
Anti-patterns
- Running this skill on every commit. It's for migration files, not application code.
- Auto-applying the migration after a green review — the user runs it.
- Reviewing the migration system's output (e.g., a
prisma migrate devlog) instead of the migration file itself.