# Sqlcmd

> Run ad-hoc SQL Server diagnostics safely from an agent shell. Use before invoking sqlcmd directly when the task needs schema inspection, read-only data checks, stored procedure execution, tSQLt runs, timing probes, or quote/env handling guidance.

- **Type:** Skill
- **Install:** `agentstack add skill-zazzcode-zazz-skills-sqlcmd`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [zazzcode](https://agentstack.voostack.com/s/zazzcode)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [zazzcode](https://github.com/zazzcode)
- **Source:** https://github.com/zazzcode/zazz-skills/tree/main/.agents/skills/sqlcmd

## Install

```sh
agentstack add skill-zazzcode-zazz-skills-sqlcmd
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# sqlcmd

Use `sqlcmd` only when a repository recipe does not already cover the diagnostic. Prefer repo-local commands such as `just db-test`, `make test-db`, migration recipes, or integration tests when they exist.

## Safety Defaults

- Prefer a test, development, or disposable database. Never run write or destructive diagnostics against production.
- Load connection settings from the repo's environment mechanism; do not hardcode passwords, hosts, ports, or database names.
- Use read-only queries unless the user or test recipe explicitly requires writes.
- Include `-b` in scripts when SQL errors should fail the command.
- Use `-C` only for trusted local containers or environments where the repo documents self-signed certificates.
- Redact secrets from output.

## Invocation Pattern

Adapt the variable names to the repo's `.env`, secrets manager, or wrapper script:

```bash
sqlcmd \
  -S "$DB_HOST,$DB_PORT" \
  -U "$DB_USER" \
  -P "$DB_PASSWORD" \
  -d "$DB_NAME" \
  -C \
  -Q "select @@VERSION"
```

If the repo uses an env wrapper, place `sqlcmd` inside that wrapper instead of exporting secrets in your shell.

## Quoting Rules

- Wrap the whole SQL batch passed to `-Q` in shell double quotes so environment variables can expand outside the SQL.
- Use SQL single quotes for string literals inside the batch: `where Name = 'Example'`.
- Do not use shell-escaped double quotes as SQL string literals; SQL Server may interpret them as identifiers.
- For multi-statement or hard-to-quote probes, prefer a repo-local scratch file only when the repo allows temporary files. Delete the scratch file afterward.

## Useful Recipes

Run a tSQLt class:

```bash
sqlcmd -S "$DB_HOST,$DB_PORT" -U "$DB_USER" -P "$DB_PASSWORD" -d "$DB_NAME" -C -b \
  -Q "exec tSQLt.Run 'test_ExampleProcedure'"
```

Return compact scalar output:

```bash
sqlcmd -S "$DB_HOST,$DB_PORT" -U "$DB_USER" -P "$DB_PASSWORD" -d "$DB_NAME" -C -h-1 -W \
  -Q "set nocount on; select count(*) from sys.tables"
```

Inspect object columns:

```bash
sqlcmd -S "$DB_HOST,$DB_PORT" -U "$DB_USER" -P "$DB_PASSWORD" -d "$DB_NAME" -C -h-1 -W \
  -Q "set nocount on; select c.name, t.name, c.max_length, c.precision, c.scale
      from sys.columns c
      join sys.types t on t.user_type_id = c.user_type_id
      where c.object_id = object_id('dbo.ExampleObject')
      order by c.column_id"
```

Time a query:

```bash
sqlcmd -S "$DB_HOST,$DB_PORT" -U "$DB_USER" -P "$DB_PASSWORD" -d "$DB_NAME" -C \
  -Q "set statistics time on; set nocount on; exec dbo.ExampleProcedure @ExampleID = 1"
```

## Output

Report the command shape, target environment class, result summary, and any uncertainty about whether the diagnostic used the intended database.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [zazzcode](https://github.com/zazzcode)
- **Source:** [zazzcode/zazz-skills](https://github.com/zazzcode/zazz-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-zazzcode-zazz-skills-sqlcmd
- Seller: https://agentstack.voostack.com/s/zazzcode
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.