Process use when you need to work with security and compliance. This skill provides security scanning and vulnerability detection with comprehensive guidance and automation. Trigger with phrases like "scan for vulnerabilities", "implement security controls", or "audit security".
npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill scanning-database-securityLoading…
Audit database security configurations, user privileges, network exposure, and data protection controls for PostgreSQL, MySQL, and MongoDB. This skill scans for common vulnerabilities including excessive privileges, missing encryption, default passwords, exposed network ports, unpatched versions, and SQL injection vectors in application code.
psql, mysql, or mongosh CLI tools installedpostgresql.conf, pg_hba.conf, my.cnf, mongod.conf)Check authentication configuration by reviewing pg_hba.conf (PostgreSQL) or mysql.user table. Flag any entries using trust authentication, allowing connections without passwords. Verify password_encryption = scram-sha-256 (not md5) in PostgreSQL.
Audit user privileges by querying role memberships and grants:
SELECT r.rolname, r.rolsuper, r.rolinherit, r.rolcreaterole, r.rolcreatedb FROM pg_roles r WHERE r.rolcanlogin = trueSELECT user, host, Super_priv, Grant_priv, File_priv FROM mysql.userGRANT OPTIONScan for default or weak credentials. Check for accounts with no password: PostgreSQL SELECT rolname FROM pg_roles WHERE rolpassword IS NULL AND rolcanlogin = true. Check for well-known default accounts (postgres with default password, root without password, admin/admin).
Verify network security:
listen_addresses in postgresql.conf (should not be * in production without firewall)SHOW ssl should return on; pg_hba.conf should use hostssl instead of hostCheck encryption at rest:
SELECT column_name, data_type FROM information_schema.columns WHERE column_name ILIKE '%password%' OR column_name ILIKE '%ssn%' OR column_name ILIKE '%credit_card%'Scan application source code for SQL injection vulnerabilities using Grep:
"SELECT * FROM " + variable or Python f-strings with interpolated table namesraw() or execute() calls with string interpolationReview database object permissions:
SELECT grantee, table_name, privilege_type FROM information_schema.table_privileges WHERE grantee = 'PUBLIC'SECURITY DEFINER only when necessaryAudit logging configuration:
log_connections = on, log_disconnections = on in PostgreSQLlog_statement = 'ddl' or 'all' for sensitive databasesCheck for known CVEs by comparing the database version against the latest security advisories. Flag databases running versions with known critical vulnerabilities.
Generate a security findings report with severity levels (Critical, High, Medium, Low), affected components, evidence (query output showing the vulnerability), and specific remediation commands.
| Error | Cause | Solution |
|---|---|---|
| Permission denied querying pg_roles or mysql.user | Scanner account lacks privilege to read user metadata | Grant pg_read_all_settings and pg_read_all_stats roles; or run scan with superuser credentials in a controlled session |
| Cannot access postgresql.conf from SQL | File-system access restricted; pg_file_settings view not available | Use SHOW ALL to check runtime settings; request file access from ops team; use pg_settings catalog view |
| SSL certificate errors during scan | Self-signed certificates or expired certificates on database | Note as a finding; generate new certificates with openssl; configure ssl_cert_file and ssl_key_file |
| Source code scan produces false positives | Dynamic SQL construction that uses proper parameterization | Review flagged locations manually; whitelist confirmed-safe patterns; focus on string concatenation with user input |
| Database version check shows EOL version | Database version no longer receiving security patches | Prioritize as critical finding; plan upgrade path; apply last available patches as interim measure |
PostgreSQL security audit revealing over-privileged roles: Scan discovers 5 application users with SUPERUSER privilege, pg_hba.conf using trust for local connections, and SSL disabled. Remediation: revoke SUPERUSER, create application-specific roles with minimum privileges, switch to scram-sha-256 authentication, and enable SSL with Let's Encrypt certificates.
SQL injection scan of a Node.js application: Grep finds 12 instances of db.query("SELECT * FROM users WHERE id = " + req.params.id) across 4 files. Remediation: replace with parameterized queries db.query("SELECT * FROM users WHERE id = $1", [req.params.id]). Each finding includes file path, line number, and corrected code.
PCI-DSS compliance check for payment database: Scan verifies: credit card numbers stored as hashed values (pass), audit logging enabled for cardholder data tables (pass), database admin accounts shared among team members (fail - individual accounts required), backups unencrypted on S3 (fail - enable SSE-S3). Produces compliance gap report with remediation timeline.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).