Grdb
johnrogers/claude-swift-engineering
A skill your agent uses when writing raw SQL with GRDB, complex joins across 4+ tables, window functions, ValueObservation for reactive queries, or dropping down from SQLiteData for performance.
Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source.
Install Osquery Query Helper
$ npx skills add tsale/awesome-dfir-skills --skill osquery-query-helper -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install tsale/awesome-dfir-skills osquery-query-helper --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/tsale/awesome-dfir-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/hunting/osquery-helper .claude/skills/osquery-query-helper && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "osquery-query-helper" agent skill from https://github.com/tsale/awesome-dfir-skills/tree/main/skills/hunting/osquery-helper into .claude/skills/osquery-query-helper/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osquery-query-helper", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/tsale/awesome-dfir-skills/tree/main/skills/hunting/osquery-helperType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add tsale/awesome-dfir-skills --skill osquery-query-helper -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install tsale/awesome-dfir-skills osquery-query-helper --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/tsale/awesome-dfir-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/hunting/osquery-helper .agents/skills/osquery-query-helper && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "osquery-query-helper" agent skill from https://github.com/tsale/awesome-dfir-skills/tree/main/skills/hunting/osquery-helper into .agents/skills/osquery-query-helper/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osquery-query-helper", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add tsale/awesome-dfir-skills --skill osquery-query-helper -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install tsale/awesome-dfir-skills osquery-query-helper --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/tsale/awesome-dfir-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/hunting/osquery-helper .cursor/skills/osquery-query-helper && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "osquery-query-helper" agent skill from https://github.com/tsale/awesome-dfir-skills/tree/main/skills/hunting/osquery-helper into .cursor/skills/osquery-query-helper/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osquery-query-helper", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/tsale/awesome-dfir-skills.git --path skills/hunting/osquery-helper--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add tsale/awesome-dfir-skills --skill osquery-query-helper -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install tsale/awesome-dfir-skills osquery-query-helper --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/tsale/awesome-dfir-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/hunting/osquery-helper .gemini/skills/osquery-query-helper && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "osquery-query-helper" agent skill from https://github.com/tsale/awesome-dfir-skills/tree/main/skills/hunting/osquery-helper into .gemini/skills/osquery-query-helper/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osquery-query-helper", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install tsale/awesome-dfir-skills osquery-query-helperInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add tsale/awesome-dfir-skills --skill osquery-query-helper -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/tsale/awesome-dfir-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/hunting/osquery-helper .github/skills/osquery-query-helper && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "osquery-query-helper" agent skill from https://github.com/tsale/awesome-dfir-skills/tree/main/skills/hunting/osquery-helper into .github/skills/osquery-query-helper/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osquery-query-helper", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add tsale/awesome-dfir-skills --skill osquery-query-helper -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install tsale/awesome-dfir-skills osquery-query-helper --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/tsale/awesome-dfir-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/hunting/osquery-helper .opencode/skills/osquery-query-helper && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "osquery-query-helper" agent skill from https://github.com/tsale/awesome-dfir-skills/tree/main/skills/hunting/osquery-helper into .opencode/skills/osquery-query-helper/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osquery-query-helper", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
osquery-query-helper- GitHub stars
- 323
- Token cost
- ~1.5k tokens
- SKILL.md length
- 632 words
- Files
- 4 (incl. scripts)
- Skills in repo
- 5
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source.
- Works in 8 steps: Search for Relevant Tables → Extract Full Table Definition → Verify Before Using → …
- Tasks that involve SQL
- SKILL.md covers What This Skill Does, When to Use, Schema File Format and Schema Lookup Procedure, plus 2 more sections
- Runs Shell scripts from its folder; calls bash
What it does
Osquery Query Helper is an agent skill from tsale/awesome-dfir-skills. Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source.
Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts (for example `scripts/detect-format.sh` and `scripts/extract-table.sh`).
It sits in Databases, covering SQL. It works with SQL, Linux and macOS. The repository describes itself as: A curated collection of DFIR skills and workflows for InfoSec practitioners. The licence is Apache-2.0.
When your agent uses it
- Tasks that involve SQL
Example prompts
- “/osquery-query-helper”
Requirements
- A Bash shell
Workflow steps
8 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 6e52942. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 2 files in scripts/ (Shell), which the agent can run.
Shell commands in SKILL.md call:
bash
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Osquery Query Helper loads about 1.5k tokens when it runs. Until then it costs about 38 tokens; SKILL.md has 632 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from tsale/awesome-dfir-skills at commit 6e52942, republished under its Apache-2.0 licence (© tsale). 632 words, ~1,493 tokens.
Download SKILL.mdSave it as
.claude/skills/osquery-query-helper/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.- name
- osquery-query-helper
- description
- Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source.
Osquery Query Helper
What This Skill Does
Help users with all aspects of osquery query work:
- Write queries from scratch based on investigation goals
- Validate queries the user has written against the schema
- Troubleshoot queries that aren't working as expected
- Suggest improvements for performance and accuracy
All work is grounded in the tables and columns defined in the provided schema files for the specified EDR platform.
When to Use
- User needs a query written for incident response or threat hunting
- User wants to validate an existing query against the correct schema
- User has a query that's failing and needs help troubleshooting
- User wants suggestions to improve query performance
Schema File Format
Schema files are located in resources/ and named by EDR platform: <platform>_osquery_schema.spec
standard_osquery_schema.spec— Baseline vanilla osquery (default when no platform specified)- EDR-specific examples:
bitdefender_,kolide_,crowdstrike_,sentinelone_,carbonblack_
To discover available platforms:
ls resources/*_osquery_schema.spec 2>/dev/null || ls resources/*.specPlatform Notation Formats
Schema files use one of two formats to indicate OS compatibility:
Format 1: Explicit platforms([...]) field
table_name("<table_name>")
description("Brief description.")
schema([
Column("column_name", TYPE, "Column description")
])
implementation("<table_name>@genTable")
platforms(["darwin", "linux", "windows"])Format 2: #platform marker before table definitions
A platform marker on its own line applies to all tables until the next marker:
#darwin
table_name("<mac_only_table>")
...
#linwin
table_name("<linux_windows_table>")
...Platform Marker Reference
| Marker | Platforms |
|---|---|
#darwin | macOS only |
#linux | Linux only |
#windows | Windows only |
#linwin | Linux and Windows |
#macwin | macOS and Windows |
#posix | macOS, Linux, FreeBSD |
#sleuthkit | macOS, Linux (requires The Sleuth Kit) |
#utility | Cross-platform utility tables |
#cross-platform | All supported platforms |
Schema Lookup Procedure
The schema files are large. Always follow the workflow below to extract table definitions.
Helper scripts are provided in scripts/ to simplify complex operations:
scripts/detect-format.sh- Determines schema formatscripts/extract-table.sh- Extracts complete table definitions
1. Search for Relevant Tables
# Search by table name keyword
grep -i 'table_name(".*<keyword>' "$SCHEMA_FILE"
# Search descriptions for concepts
grep -i 'description(".*<concept>' "$SCHEMA_FILE"2. Extract Full Table Definition
Use the extraction script to get the complete table definition:
bash scripts/extract-table.sh <schema_file> <table_name>Example:
bash scripts/extract-table.sh resources/standard_osquery_schema.spec processesThe script automatically:
- Detects the schema format (platforms array vs platform markers)
- Extracts the complete table definition including all columns and platform info
- Includes the
#platformmarker for Format 2 schemas
If you need to check the format manually:
bash scripts/detect-format.sh <schema_file>
# Returns: "platforms_array" or "platform_markers"3. Verify Before Using
- Confirm columns exist: Only use columns explicitly listed in the
schema([...])block - Check OS compatibility: Via
platforms([...])field or preceding#platformmarker - If unsupported: Inform the user and suggest alternatives
Guidelines
Show full SKILL.md (276 more words)Show less
When Writing Queries
- Schema is law: Only use tables/columns confirmed via grep from the correct platform schema
- Platform awareness: Verify OS support for each table
- Performance first: Always include
WHEREclauses, useLIMITfor exploration, avoidSELECT *, minimize JOINs - Use placeholders:
'<path_to_file>','<username>','<timestamp>','<ip_address>' - Be upfront about gaps: If a table/column doesn't exist, say so and suggest alternatives
When Validating User Queries
- Verify each table exists in the platform schema
- Confirm all referenced columns exist
- Check OS compatibility
- Flag performance issues (missing WHERE, SELECT *, expensive JOINs)
- Offer corrected queries, not just problems
When Troubleshooting
- Start with schema—most failures are mismatches
- Check basics: table exists, columns spelled correctly, OS supported
- Consider EDR differences—query may be from a different platform
- Explain why something failed, not just how to fix it
Safety and Privacy
- Redact sensitive data in examples
- Query only necessary data
- Prefer hashes over file content dumps
- Use time constraints to limit data volume
Workflow
0. Identify EDR Platform
Ask user or check context. Default to standard_osquery_schema.spec if unspecified.
1. Understand the Request
Writing new query? Validating? Troubleshooting? What data is needed?
2. Search and Extract Schema
Use grep to find tables, then bash scripts/extract-table.sh to get full definitions. Verify columns and OS compatibility from the extracted output.
3. Write, Validate, or Fix
Use only verified tables/columns. Add WHERE clauses and LIMIT for performance.
4. Deliver Response
Include:
- EDR platform/schema used
- Schema lookups performed (show grep commands)
- The query with syntax highlighting
- Explanation of what it does or what was wrong
- Assumptions (platform, OS, environment)
- Limitations (missing tables/columns, OS restrictions, performance concerns)
© tsale, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 3 other files (scripts) in skills/hunting/osquery-helper of tsale/awesome-dfir-skills.
- SKILL.md
- resources/standard_osquery_schema.spec
- scripts/detect-format.sh
- scripts/extract-table.sh
Open the folder on GitHubat commit 6e52942
Compare with similar skills
Osquery Query Helper next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Osquery Query Helper this skilltsale/awesome-dfir-skills | 323 | — | ~1.5k | Automated safety check: Pass | Apache-2.0 | |
| Grdbjohnrogers/claude-swift-engineering | 231 | — | ~719 | Automated safety check: Pass | MIT | |
| RevopsAvdLee/RocketSimApp | 804 | 6 repos | ~3.7k | Automated safety check: Pass | Custom licence | |
| Forensics OsqueryAgentSecOps/SecOpsAgentKit | 220 | 1 repos | ~4.9k | Automated safety check: Notes | Custom licence | |
| Evolving The Data ModelTriliumNext/Trilium | 38k | — | ~2.1k | Automated safety check: Pass | AGPL-3.0 | |
| Safe SQL Executionsupabase/supabase | 111k | — | ~4.2k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Revops
AvdLee/RocketSimApp
When the user wants help with revenue operations, lead lifecycle management, or marketing-to-sales handoff processes.
Forensics Osquery
AgentSecOps/SecOpsAgentKit
SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.
Evolving The Data Model
TriliumNext/Trilium
A skill your agent uses when adding a DB migration or a new column/field to a Becca entity in Trilium ("add a migration", "new column on notes/attributes", "ALTER TABLE", "add a field to…
- Official
Safe SQL Execution
supabase/supabase
A skill your agent uses whenever code will build, return, fetch, or execute SQL that runs against a user's real Postgres database — even when the request reads like an ordinary feature or bug fix…
Citus Backport
citusdata/citus
Backport one or more merged citusdata/citus main commits/PRs onto the active release branches.
More from tsale/awesome-dfir-skills
Malware Analysis
tsale/awesome-dfir-skills
Professional malware analysis workflow for PE executables and suspicious files.
Admiralty System
tsale/awesome-dfir-skills
Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach analysis.
Analysing Attack
tsale/awesome-dfir-skills
Analyse Mitre ATT&CK tactics, techniques and sub-techniques.
Threat Actor Profiling
tsale/awesome-dfir-skills
Build structured threat actor profiles using the 5W1H framework and the Diamond Model.
Related
Categories
Questions about Osquery Query Helper
What does Osquery Query Helper do?
Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source. Osquery Query Helper is an agent skill from tsale/awesome-dfir-skills. Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source.
When should I use Osquery Query Helper?
Osquery Query Helper fits situations like: tasks that involve SQL.
How do I install Osquery Query Helper in Claude Code?
Run `npx skills add tsale/awesome-dfir-skills --skill osquery-query-helper -a claude-code`. Or copy the skill folder (skills/hunting/osquery-helper in tsale/awesome-dfir-skills) into .claude/skills/osquery-query-helper in your project. Claude Code loads it when a task matches its description.
How do I install Osquery Query Helper in Codex?
Run `npx skills add tsale/awesome-dfir-skills --skill osquery-query-helper -a codex`. Or copy the skill folder (skills/hunting/osquery-helper in tsale/awesome-dfir-skills) into .agents/skills/osquery-query-helper in your project. Codex loads it when a task matches its description.
Can I use Osquery Query Helper in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add tsale/awesome-dfir-skills --skill osquery-query-helper -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/osquery-query-helper, .gemini/skills/osquery-query-helper, .github/skills/osquery-query-helper and .opencode/skills/osquery-query-helper in your project.
What does Osquery Query Helper need to run?
Going by SKILL.md and its folder, Osquery Query Helper needs a shell for the scripts in its folder and the command-line tools its instructions call (bash). Our summary lists: A Bash shell.
Does Osquery Query Helper access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Osquery Query Helper safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Osquery Query Helper use?
Osquery Query Helper is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Osquery Query Helper use?
About 1.5k tokens (SKILL.md is roughly 6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Osquery Query Helper?
Skills that share tags, products or a category with Osquery Query Helper: Grdb (johnrogers/claude-swift-engineering, 231 stars), Revops (AvdLee/RocketSimApp, 804 stars), Forensics Osquery (AgentSecOps/SecOpsAgentKit, 220 stars) and Evolving The Data Model (TriliumNext/Trilium, 38k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Osquery Query Helper?
tsale (a GitHub user) maintains it in tsale/awesome-dfir-skills, which has 323 GitHub stars. The repository holds 5 skills in this directory. The repository was last updated on May 14, 2026.
Source: tsale/awesome-dfir-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.