Agent skill · security · jeremylongshore
scanning-database-security
Process use when you need to work with security and compliance.
Why this skill is useful
Adds executable scripts for comprehensive database security scanning and vulnerability detection that aren't in public docs.
What it needs
Requires mongosh, mysql, psql installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Database Security Scanner Overview Audit database security configurations, user privileges, network exposure, and data protection controls for PostgreSQL, MySQL, and MongoDB. This skill scans for common vulnerabilities including excessive privileges, missing encryption, default passwords, exposed network ports, unpatched versions, and SQL injection vectors in application code. Prerequisites Database admin credentials for querying system catalogs and security settings psql, mysql, or mongosh CLI tools installed Access to database configuration files (postgresql.conf, pghba.conf, my.cnf, mongod.conf) Application source code access for SQL injection scanning (using Grep/Glob tools) Knowledge of applicable compliance frameworks (SOC 2, HIPAA, PCI-DSS, GDPR) Instructions 1. Check authentication configuration by reviewing pghba.conf (PostgreSQL) or mysql.user table. Flag any entries using trust authentication, allowing connections without passwords. Verify passwordencryption = scram-sha-256 (not md5) in PostgreSQL. 2. Audit user privileges by querying role memberships and grants: PostgreSQL: SELECT r.rolname, r.rolsuper, r.rolinherit, r.rolcreaterole, r.rolcreatedb FROM pgroles r WHERE r.rolcanlogin = true MySQL: SELECT user, host, Superpriv, Grantpriv, Filepriv FROM mysql.user Flag users with superuser/SUPER privilege, excessive grants, or GRANT OPTION 3. Scan for default or weak credentials. Check for accounts with no password: PostgreSQL SELECT rolname FROM pgroles WHERE rolpassword IS NULL AND rolcanlogin = true. Check for well-known default accounts (postgres with default password, root without password, admin/admin). 4. Verify network security: Check listenaddresses in postgresql.conf (should not be in production without firewall) Verify SSL/TLS is enforced: SHOW ssl should return on; pghba.conf should use hostssl instead of host Confirm database port is not exposed to the public internet 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/scanning-database-security