Individual skill

network-database-security

Assess reachable database services — PostgreSQL/MySQL/MSSQL/MongoDB/Redis — for unauthenticated access, weak/default accounts, over-broad grants, and dangerous features (xp_cmdshell, COPY FROM PROGRAM, UDF, Redis file write) that turn a DB login into OS code execution. Load when recon shows 3306/5432/1433/6379/27017, leaked app config yields DB creds, or a database review is in scope. Signals: 0.0.0.0 bind, unauth Redis PONG, mysql.user host '%', FILE priv, secure_file_priv empty, xp_cmdshell.

skills/network/network-database-security/SKILL.md

Read pinned source

Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 7, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 27
Repository last updated: Oct 14, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai-agents Repository topic
ai-security Repository topic
application-security Repository topic
blue-team Repository topic
bug-bounty Repository topic
claude-code Repository topic
codex Repository topic
detection-engineering Repository topic
gemini Repository topic
data Derived category
security Derived category
data-databases Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 5,625 bytes

Read excerpt


# Database security assessment

## When it applies
An authorized engagement has a reachable database instance — surfaced by `network-service-attacks`,
handed over as a review target, or via app credentials recovered from a config dump. Covers
PostgreSQL, MySQL/MariaDB, MSSQL, MongoDB, and Redis. Before touching anything, confirm in
`scope.txt` (see `tradecraft-scope-roe`): which instances, which accounts, and **whether
write/delete/exec is permitted**. On production systems, default to read-only proofs — no
destructive statements unless explicitly allowed.

## Why it works
Databases concentrate the crown jewels yet are routinely deployed as "internal-only": bound to
`0.0.0.0`, default or weak accounts, grants far wider than the app needs, and dangerous features
left enabled. Features like `xp_cmdshell`, `COPY ... FROM PROGRAM`, UDFs, and Redis's writable