database-security
Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.
Works with
--- name: database-security description: Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review. license: MIT --- # Database Security Assessment ## ACTION REQUIRED（读完后立刻执行） 1. `NOW`: 读取 precedent-pentest；**生产库禁止破坏性语句** unless 明确允许 2. `NOW`: scope 写清实例、账号权限、是否允许写/删 3. `NEXT`: 客户端工具路径 4. `ACT`: 暴露面 → 认证 → 授权 → 配置 → 利用链验证（安全） ## 适用场景 - 数据库未授权/弱口令/错误绑定 0.0.0.0 - 权限过大、危险功能（xp_cmdshell、COPY PROGRAM、UDF） - 横向：从应用账号到 DBA - NoSQL 注入与 Redis 写文件等（授权环境） ## 工作流 ```text □ 网络暴露与 TLS □ 账号角色与 grantee □ 敏感表访问控制 □ 危险配置：file_priv、xp_cmdshell、load_file □ 审计日志是否开启 □ 备份与快照权限 ``` ## 工具链 | 工具 | 用途 | |------|------| | 官方 CLI | 连接与枚举 | | sqlmap | 注入验证（授权） | | nuclei | 已知暴露模板 | | 云 RDS 控制台审计 | 配置 | ## 参考 - `references/db-misconfig-checklist.md` - `../pentest-tools/` `../cloud-k8s/` ## 路由上下文 **上游**: MASTER R35 **下游**: 获 OS 命令 → attack-chain；云托管 → cloud-k8s ## 任务完成自检 - [ ] 是否避免未授权写删？ - [ ] 是否区分配置问题与可利用链？ - [ ] Checklist？
More Database skills
supabase-postgres-best-practices
supabase/agent-skills
Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill BEFORE writing or changing anything that lives in a Postgres database: creating or altering tables and columns (including choosing column types), schema design, migrations and declarative schema files, RLS policies and the tests that verify them, indexes, triggers, database functions, queues and scheduled jobs (pg_cron, pgmq), vector/semantic search (pgvector), and restoring dumps (pg_restore) or importing data. Also load it when diagnosing slow queries, high CPU, timeouts, EXPLAIN plans, connection exhaustion, locking, bloat, or rows visible to the wrong user or tenant. This is not just a performance guide — schema, migration, security, and SQL authoring tasks need these rules too, even for a one-column change or a single query.
prisma-database-setup
prisma/skills
Guides for configuring Prisma with different database providers (PostgreSQL, MySQL, SQLite, MongoDB, etc.). Use when setting up a new project, changing databases, or troubleshooting connection issues. Triggers on "configure postgres", "connect to mysql", "setup mongodb", "sqlite setup".
prisma-postgres
prisma/skills
Prisma Postgres setup and operations guidance across Console, create-db CLI, Management API, and Management API SDK. Use when creating Prisma Postgres databases, working in Prisma Console, provisioning with create-db/create-pg/create-postgres, or integrating programmatic provisioning with service tokens or OAuth.
