no-handler-direct-sql-execution
Do not call Query/Exec/Begin from an HTTP handler.
Skill by StopThatSlop
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/stopthatslop-no-handler-direct-sql-execution
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: backend, writing
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/no-handler-direct-sql-execution
What's inside
- Skill name
no-handler-direct-sql-execution- Description
- Do not call Query/Exec/Begin from an HTTP handler. Move SQL to a store. Use only when editing Go HTTP handlers. Do not use for store packages or tests.
- License
- MIT
- Metadata
- pack: stopthatslop-go-v1 · globs: **/*.go · engine_rule_id: go.architecture.no-handler-direct-sql-execution
- Instructions
- 30 lines in SKILL.md · view on GitHub
Files (1)
- SKILL.md
SKILL.md (first lines)
# Handlers do not run SQL
Handler SQL skips the persistence boundary and makes the handler untestable.
## Do
```go
func (h *Handler) Get(w http.ResponseWriter, r *http.Request) {
row, err := h.store.Invoice(r.Context(), id)
}
```
## Do not
```go
func (h *Handler) Get(w http.ResponseWriter, r *http.Request) {
row := h.db.QueryRow(`SELECT id FROM invoices WHERE id = $1`, id)
}
```
## Enforce
CI gates this rule (`enforcement: checker`):
```bash
python3 scripts/check.py --repo-root . --pack go --rule go.architecture.no-handler-direct-sql-execution
```From StopThatSlop/stopthatslop, MIT.
More from StopThatSlop/stopthatslop
- 0.569score
no-floating-promises
StopThatSlop
Do not leave async calls unawaited.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-empty-catch-in-express-handlers
StopThatSlop
Do not swallow errors in Express handlers with empty catch blocks.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-except-exception-pass
StopThatSlop
Do not swallow errors with `except Exception: pass`.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-after-commit-dispatch-from-after-commit-listener
StopThatSlop
Do not re-register after-commit work from an AFTER_COMMIT @TransactionalEventListener.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-eager-to-many-fetch
StopThatSlop
Do not map OneToMany/ManyToMany as FetchType.EAGER.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-fetch-without-abort-timeout
StopThatSlop
Do not call fetch without an abort signal timeout.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-file-upload-without-validation
StopThatSlop
Do not accept MultipartFile/Part without size, type, or name checks.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-fstring-sql-interpolation
StopThatSlop
Do not build SQL by interpolating values with f-strings, .format(), or +.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-go-dynamic-sql-execution
StopThatSlop
Do not execute SQL built with fmt.Sprintf or concatenation.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-handler-detached-goroutine
StopThatSlop
Do not start a goroutine from an HTTP handler without a context from the request.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-handler-direct-outbound-http
StopThatSlop
Do not call http.Get/Post/Head or client.Do from an HTTP handler.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-handler-rooted-background-context
StopThatSlop
Do not pass context.Background() from an HTTP handler.
SkillBFreshness: B★ 4Claude Code +9
Signals
- Stars
- 4
- Forks
- 0
- Open issues
- 0
- Last commit (this folder)
- Sep 1, 2026 (1 month ago)
- Last release
- Sep 13, 2026 (1 month ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- MIT
- Repository
- github.com/StopThatSlop/stopthatslop
- Website
- stopthatslop.com
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
More from StopThatSlop
- 0.569score
no-floating-promises
StopThatSlop
Do not leave async calls unawaited.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-empty-catch-in-express-handlers
StopThatSlop
Do not swallow errors in Express handlers with empty catch blocks.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-after-commit-dispatch-from-after-commit-listener
StopThatSlop
Do not re-register after-commit work from an AFTER_COMMIT @TransactionalEventListener.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-except-exception-pass
StopThatSlop
Do not swallow errors with `except Exception: pass`.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-dynamic-sql-execution
StopThatSlop
Do not execute SQL built with f-strings, format, or concatenation.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-eager-to-many-fetch
StopThatSlop
Do not map OneToMany/ManyToMany as FetchType.EAGER.
SkillBFreshness: B★ 4Claude Code +9
Cite this page
no-handler-direct-sql-execution skill. Agent Mart. https://agentmart.dev/skills/stopthatslop-no-handler-direct-sql-execution (last updated 2026-10-24)