[ashishsinha1602]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Adds skills/schemagate-sql: a skill for answering questions about data in a large SQL database through the schemagate MCP server (Apache-2.0, open source, no paid service).

This is not another database connector. The existing PostgreSQL / MySQL / SQL Server / Data API builder servers give the model the whole schema, or let it browse table by table, and leave the hard part to the model: choosing the few tables that matter out of hundreds, and never touching the ones this user must not see. schemagate is the selection layer that does that part, and this skill teaches Copilot to use it: select the schema for the question, write one SELECT against only that DDL, run it through the checked query path, and report out-of-scope refusals as refusals.

What that gets you, with the proof:

• About 91% fewer schema tokens. Median schema-token saving on Spider 2.0-lite databases with 50+ tables: 91.1% (BENCHMARKS.md).
• Durable Ownership - Repository github/awesome-copilot will be archived #1 on the official BIRD Mini-Dev text-to-SQL leaderboard in SQLite, PostgreSQL and MySQL (81.0 / 72.6 / 72.4 execution accuracy, bird-bench.github.io).
• BIRD hidden test set, scored by the BIRD team: 74.34 EX (simple 81.03 / moderate 72.25 / challenging 56.14; leaderboard row pending), dev 84.03 EX.
• Enterprise warehouses: 31-39% execution accuracy on MIT's BEAVER (100-question samples), against 11.4% for the paper's best setup. Not yet an official leaderboard entry.
• Per-user scope: the model only sees tables and columns the caller may read (a policy file or the database's own GRANTs); PostgreSQL row-level-security policies are checked per role.
• Checked queries: run_query refuses writes, multiple statements and any object outside the caller's scope. Every selection and query can go to a signed audit log.
• Used in agent frameworks: listed in LangChain's retriever integrations (langchain-schemagate, works from LangChain and LangGraph), a LlamaIndex retriever on PyPI, the official MCP Registry (io.github.ashishsinha1602/schemagate), Glama and awesome-duckdb. 34.5k PyPI downloads (pepy.tech); releases carry SLSA provenance.
• One server for every engine: PostgreSQL, MySQL, SQLite, SQL Server, Oracle, Snowflake, BigQuery and DuckDB.

The skill's setup block pins schemagate[mcp]==1.15.4 and points at demo, a bundled sample schema, so it connects to nothing and needs no credentials until the user configures a real database in their own MCP config.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

• The same tool is also submitted as an external plugin through the review workflow in [External Plugin]: schemagate #6160 (intake passed). This PR adds only the skill; it does not edit plugins/external.json.
• I could not run npm start locally, so I added the docs/README.skills.md row by hand in the generated format (alphabetical, after scaffolding-...). Happy to regenerate if CI wants different output.
• Name and description are within skill:validate limits (description 423 of 1,024 characters); the folder name matches the skill name.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• Label needs-review:HIGH flags a high contributor-risk signal

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Skill validation	✅ Passed	Passed · logs
Skill lint (vally)	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for bb6aa32 · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🔒 PR Risk Scan Results

Scanned 1 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	1
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	package-exec-command	skills/schemagate-sql/SKILL.md	39	"command": "uvx",

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔴 Contributor Reputation Check: HIGH risk

Check	Risk
Profile	HIGH
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ schemagate-sql (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/schemagate-sql
✅ schemagate-sql (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

[ashishsinha1602]

/request-review

[github-actions]

🙋 Added needs-reviewer. Reviewer routing is assigning a reviewer now.