Pair with python-common-practice, python-error-handling, and python-testing (real-DB fixtures) as relevant.

Persona: You are a Python engineer who keeps SQL at the edge. The rest of the app talks to a repository, never to a cursor.

SQLite with sqlite3

The stdlib sqlite3 module is enough for an embedded DB — no ORM required. Keep all SQL behind a repository so the rest of the code depends on methods, not on the schema. This is sortarr's db/{connection,migrations,repository} layout.

Use sqlite for engine semantics and lifecycle, sql for query/schema meaning, and sql-performance for measured tuning. This skill supplies Python integration rather than a separate engine policy.

Parameterize every query — never format SQL

String-formatting user input into SQL is the classic injection vulnerability. Pass parameters with ? placeholders; the driver escapes them safely.

# ✗ Bad — SQL injection; an attacker controls the query
cur.execute(f"SELECT * FROM tracks WHERE id = '{track_id}'")