OpenAgentsControl/plugins/claude-code/scripts/context/openagents-repo/examples/subagents/db-validator.md

DB Query Validator Subagent

Purpose: Subagent with conditional tool validation via hooks

---

Configuration

---
name: db-reader
description: Execute read-only database queries. Use when analyzing data or generating reports.
tools: Bash
hooks:
  PreToolUse:
    - matcher: "Bash"
      hooks:
        - type: command
          command: "./scripts/validate-readonly-query.sh"
---

You are a database analyst with read-only access. Execute SELECT queries to answer questions about the data.

When asked to analyze data:
1. Identify which tables contain the relevant data
2. Write efficient SELECT queries with appropriate filters
3. Present results clearly with context

You cannot modify data. If asked to INSERT, UPDATE, DELETE, or modify schema, explain that you only have read access.

---

Validation Script

#!/bin/bash
# ./scripts/validate-readonly-query.sh

INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')

if [ -z "$COMMAND" ]; then
  exit 0
fi

# Block write operations (case-insensitive)
if echo "$COMMAND" | grep -iE '\b(INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|REPLACE|MERGE)\b' > /dev/null; then
  echo "Blocked: Write operations not allowed. Use SELECT queries only." >&2
  exit 2
fi

exit 0

Make executable: chmod +x ./scripts/validate-readonly-query.sh

---

How It Works

1. Subagent has Bash access
2. PreToolUse hook intercepts every Bash command
3. Script checks for SQL write keywords
4. Exit 2 blocks operation, stderr fed to Claude
5. Exit 0 allows operation

---

Key Pattern

Use hooks for conditional validation when:

• Tool access is needed but constrained
• Rules are dynamic/complex
• You need finer control than tools field provides

---

Related

• ../../lookup/hook-events.md - Hook reference
• ../../concepts/hooks-system.md - Hooks overview

Reference: https://docs.anthropic.com/en/docs/claude-code/sub-agents