| name | scanning-database-security |
| description | Process use when you need to work with security and compliance.
This skill provides security scanning and vulnerability detection with comprehensive guidance and automation.
Trigger with phrases like "scan for vulnerabilities", "implement security controls",
or "audit security".
|
| allowed-tools | Read, Write, Edit, Grep, Glob, Bash(psql:*), Bash(mysql:*), Bash(mongosh:*) |
| version | 1.27.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| tags | ["database","security","compliance","audit"] |
| compatibility | Designed for Claude Code, also compatible with Codex and OpenClaw |
Database Security Scanner
Overview
Audit database security configurations, user privileges, network exposure, and data protection controls for PostgreSQL, MySQL, and MongoDB. This skill scans for common vulnerabilities including excessive privileges, missing encryption, default passwords, exposed network ports, unpatched versions, and SQL injection vectors in application code.
Prerequisites
- Database admin credentials for querying system catalogs and security settings
psql, mysql, or mongosh CLI tools installed- Access to database configuration files (
postgresql.conf, pg_hba.conf, my.cnf, mongod.conf)
- Application source code access for SQL injection scanning (using Grep/Glob tools)
- Knowledge of applicable compliance frameworks (SOC 2, HIPAA, PCI-DSS, GDPR)
Instructions
-
Check authentication configuration by reviewing pg_hba.conf (PostgreSQL) or mysql.user table. Flag any entries using trust authentication, allowing connections without passwords. Verify password_encryption = scram-sha-256 (not md5) in PostgreSQL.
-
Audit user privileges by querying role memberships and grants:
- PostgreSQL:
SELECT r.rolname, r.rolsuper, r.rolinherit, r.rolcreaterole, r.rolcreatedb FROM pg_roles r WHERE r.rolcanlogin = true
- MySQL:
SELECT user, host, Super_priv, Grant_priv, File_priv FROM mysql.user
- Flag users with superuser/SUPER privilege, excessive grants, or
GRANT OPTION
-
Scan for default or weak credentials. Check for accounts with no password: PostgreSQL SELECT rolname FROM pg_roles WHERE rolpassword IS NULL AND rolcanlogin = true. Check for well-known default accounts (postgres with default password, root without password, admin/admin).
-
Verify network security:
- Check
listen_addresses in postgresql.conf (should not be * in production without firewall)
- Verify SSL/TLS is enforced:
SHOW ssl should return on; pg_hba.conf should use hostssl instead of host
- Confirm database port is not exposed to the public internet
