database-security
Skill5 starsChanged 13 days agoMITView on GitHub
Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.
4 other projects use a version of this, 2 of them edited.
Adopted by
Most recently taken up by
- zhaoxuya520/reverse-skill-privateedited, first seen Oct 8, 2026
- zhaoxuya520/reverse-skilledited, first seen Sep 22, 2026
- Rootx202/appsec-skillstheir own version, first seen Jul 13, 2026
- JeremyMorgan/code-review-skillstheir own version, first seen Jun 3, 2026
Other versions4 projects use a version of this.
Word for word · 0
None found.
Edited · 2
- zhaoxuya520/reverse-skill-private★ 40k100% same
- zhaoxuya520/reverse-skill★ 38k100% same
Wrote their own version · 2
- JeremyMorgan/code-review-skills★ 15same name
- Rootx202/appsec-skills★ 2same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository119 other files it gives its agents.
- AGENTS.mdAGENTS.md
- templates/AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- accessibilitySkill
- frontend-designSkill
- python-background-jobsSkill
- python-executorSkill
- python-testing-patternsSkill
- seoSkill
- ai-slop-cleanerSkill
- analyzeSkill
- api-and-interface-designSkill
- ask-claudeSkill
- ask-geminiSkill
- autopilotSkill
- browser-testing-with-devtoolsSkill
- build-fixSkill
- cancelSkill
- ci-cd-and-automationSkill
- clawd-change-workflowSkill
- code-review-and-qualitySkill
- code-reviewSkill
- code-simplificationSkill
- configure-notificationsSkill
- context-engineeringSkill
- debugging-and-error-recoverySkill
- deep-interviewSkill
- deepsearchSkill
- deprecation-and-migrationSkill
- doctorSkill
- documentation-and-adrsSkill
- ecomodeSkill
- frontend-ui-engineeringSkill
- frontend-ui-uxSkill
- git-masterSkill
- git-workflow-and-versioningSkill
- helpSkill
- hudSkill
- idea-refineSkill
- incremental-implementationSkill
- intent_routerSkill
- keyword_registrySkill
- mode_stateSkill
- noteSkill
- omx-setupSkill
- performance-optimizationSkill
- pipeline_orchestratorSkill
- pipelineSkill
- planning-and-task-breakdownSkill
- planSkill
- ralph-initSkill
- ralph_loopSkill
- ralphSkill
- ralplanSkill
- android-reverse-engineeringSkill
- api-securitySkill
- apk-reverseSkill
- attack-chainSkill
- binary-diffSkill
- browser-automationSkill
- The first 60 shown.
The file
Files
Database Security Assessment
ACTION REQUIRED（读完后立刻执行）
NOW: 读取 precedent-pentest；生产库禁止破坏性语句 unless 明确允许NOW: scope 写清实例、账号权限、是否允许写/删NEXT: 客户端工具路径ACT: 暴露面 → 认证 → 授权 → 配置 → 利用链验证（安全）
适用场景
- 数据库未授权/弱口令/错误绑定 0.0.0.0
- 权限过大、危险功能（xp_cmdshell、COPY PROGRAM、UDF）
- 横向：从应用账号到 DBA
- NoSQL 注入与 Redis 写文件等（授权环境）
工作流
□ 网络暴露与 TLS
□ 账号角色与 grantee
□ 敏感表访问控制
□ 危险配置：file_priv、xp_cmdshell、load_file
□ 审计日志是否开启
□ 备份与快照权限工具链
| 工具 | 用途 |
| 官方 CLI | 连接与枚举 |
| sqlmap | 注入验证（授权） |
| nuclei | 已知暴露模板 |
| 云 RDS 控制台审计 | 配置 |
参考
references/db-misconfig-checklist.md../pentest-tools/../cloud-k8s/
路由上下文
上游: MASTER R35 下游: 获 OS 命令 → attack-chain；云托管 → cloud-k8s
任务完成自检
- 是否避免未授权写删？
- 是否区分配置问题与可利用链？
- Checklist？
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.