npx skills add zhaoxuya520/reverse-skill --skill database-security
sickn33/agentic-awesome-skills
database-security
Authorized database security assessment across PostgreSQL, MySQL, MSSQL, MongoDB, and Redis: exposure, authorization gaps, UDF/command execution paths, and misconfiguration review.
Installation
$
npx skills add sickn33/agentic-awesome-skills --skill database-security
Similar popular skills
Related neighbors and high-traction skills in the same topics — useful to compare before installing.
supabase-postgres-best-practices
Shared topics
supabase/agent-skills
Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill …
391.6K installs
prisma-cli
Shared topics
prisma/skills
Prisma ORM CLI commands reference covering init, generate, migrate, db, dev, complete, studio, …
267K installs
supabase
Shared topics
supabase/agent-skills
Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge F…
263K installs
neon-postgres
Shared topics
neondatabase/agent-skills
>- Guides and best practices for working with Lakebase Postgres, the database behind Neon. Cove…
146.5K installs
firebase-data-connect
Shared topics
firebase/agent-skills
142.2K installs
prisma-database-setup
Similar name
prisma/skills
Guides for configuring Prisma with different database providers (PostgreSQL, MySQL, SQLite, Mon…
269.8K installsAlso in this package
Other skills from sickn33/agentic-awesome-skills · top by installs.
npx skills add sickn33/agentic-awesome-skills
More details
Agent compatibility
Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.
Claude Code
Not declared
Cursor
Not declared
Codex
Not declared
GitHub Copilot
Not declared
Windsurf
Not declared
Gemini CLI
Not declared
Cline
Not declared
OpenCode
Not declared
Also listed on
Alternate registries and mirrors of this skill.
Repository health
Stars
46.2K
License
LICENSE
Default branch
main
Open issues
0
Status
Active
Skill metadata
Parsed from SKILL.md frontmatter.
LicenseMIT
Package contents
Files included with this skill beyond the listing page.
-
skill md
SKILL.md2,781 B -
docs
SUMMARY.md205 B
History
- First recorded snapshot · 2 installs
SKILL.md
⚠️ AUTHORIZED USE ONLY
This skill is for educational purposes or authorized security assessments only.
You must have explicit, written permission from the system owner before using this tool.
Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate
Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
1. Ask the user to state the exact target URL, IP, account, or resource.
2. Ask the user to confirm written authorization and the permitted scope.
3. Show the exact command(s) and explain their expected effect.
4. Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
Database Security Assessment
When to Use
- Assessing database hardening and exposure within an approved scope.
- Checking authz boundaries and risky server-side execution features.
适用场景
- 数据库未授权/弱口令/错误绑定 0.0.0.0
- 权限过大、危险功能（xp_cmdshell、COPY PROGRAM、UDF）
- 横向：从应用账号到 DBA
- NoSQL 注入与 Redis 写文件等（授权环境）
工作流
□ 网络暴露与 TLS
□ 账号角色与 grantee
□ 敏感表访问控制
□ 危险配置：file_priv、xp_cmdshell、load_file
□ 审计日志是否开启
□ 备份与快照权限工具链
| 工具 | 用途 |
|---|---|
| 官方 CLI | 连接与枚举 |
| sqlmap | 注入验证（授权） |
| nuclei | 已知暴露模板 |
| 云 RDS 控制台审计 | 配置 |
参考
references/db-misconfig-checklist.md../pentest-tools/../cloud-k8s/
路由上下文
上游: MASTER R35 下游: 获 OS 命令 → attack-chain；云托管 → cloud-k8s
任务完成自检
- 是否避免未授权写删？
- 是否区分配置问题与可利用链？
- Checklist？
Limitations
- Never run against production data stores without explicit written approval.
- Active exploitation paths (UDF/command exec) are destructive-capable; simulate first.
Adapted from zhaoxuya520/reverse-skill (MIT).