Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/saprophytic-seattle561/reverse-skill/database-securitynpx skills add Saprophytic-seattle561/reverse-skill --skill database-securitygit clone --depth 1 https://github.com/Saprophytic-seattle561/reverse-skillWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.00444 |
| Opus 5 | $0.00018 | $0.00222 |
| Sonnet 5 | $0.00007 | $0.00089 |
| Haiku 4.5 | $0.00004 | $0.00044 |
Grade A, and why
database-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to database-security — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
Database Security Assessment
ACTION REQUIRED（读完后立刻执行）
NOW: 读取 precedent-pentest；生产库禁止破坏性语句 unless 明确允许NOW: scope 写清实例、账号权限、是否允许写/删NEXT: 客户端工具路径ACT: 暴露面 → 认证 → 授权 → 配置 → 利用链验证（安全）
适用场景
- 数据库未授权/弱口令/错误绑定 0.0.0.0
- 权限过大、危险功能（xp_cmdshell、COPY PROGRAM、UDF）
- 横向：从应用账号到 DBA
- NoSQL 注入与 Redis 写文件等（授权环境）
工作流
□ 网络暴露与 TLS
□ 账号角色与 grantee
□ 敏感表访问控制
□ 危险配置：file_priv、xp_cmdshell、load_file
□ 审计日志是否开启
□ 备份与快照权限
工具链
| 工具 | 用途 |
|---|---|
| 官方 CLI | 连接与枚举 |
| sqlmap | 注入验证（授权） |
| nuclei | 已知暴露模板 |
| 云 RDS 控制台审计 | 配置 |
参考
references/db-misconfig-checklist.md../pentest-tools/../cloud-k8s/
路由上下文
上游: MASTER R35
下游: 获 OS 命令 → attack-chain；云托管 → cloud-k8s
任务完成自检
- 是否避免未授权写删？
- 是否区分配置问题与可利用链？
- Checklist？
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 56 lines · 37 tokens per session scan A b052ce09f400
database-security is a skill published in the GitHub repository Saprophytic-seattle561/reverse-skill (1 stars, last pushed 2d ago), licensed MIT. It adds 37 tokens to every session and 444 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to database-security, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
searchable-events
The NIP-50 indexing surface of Quartz — the SearchableEvent interface, which event kinds are searchable, exactly what text each kind's indexableContent() contributes, how the SQLite/filesystem stores consume it, and the NIP-50 SearchQuery extension grammar plus SearchRelayListEvent (kind 10007). Use when making a kind…
event-store-semantics
The authoritative behavioral contract of Quartz's event stores — IEventStore and its reference SQLite implementation (nip01Core/store/sqlite/). Use when implementing or asserting parity with a Quartz event store (external engines like Vespa, the filesystem store, geode), answering filter-semantics questions…
maui-networking-offline-data
Build .NET MAUI networking and offline data features with HttpClient DI, JSON serialization, emulator/simulator networking, debug cleartext exceptions, SQLite persistence, sync boundaries, retries, cancellation, and error handling. USE FOR: typed HttpClient clients, Android emulator 10.0.2.2, iOS simulator localhost…
burp-scan
Burp Suite scanning via MCP tools — passive traffic analysis, active payload testing, OOB verification, and vulnerability reporting using Burp's proxy, HTTP sender, Collaborator, and scanner APIs. Use when the user has Burp Suite running with the AI Agent MCP server and wants to scan, test, or analyze web traffic…
apply-upstream-migration
Apply a new upstream Actual migration to Aktual — update MigrateDatabase.kt, SQLDelight .sq files, Adapters, model types, and the migration test. Triggered when last-known-migration.txt is updated.
room-patterns
Room persistence for the Android target (androidx.room) - @Entity, @Dao, RoomDatabase, migrations, TypeConverters, and Flow-returning queries. Android-side database. For shared/multiplatform persistence in commonMain use sqldelight-patterns. For the broader Android data layer (Repository pattern, Room plus remote…