Security audit
Security checks for vulnerabilities and agentic risk
This skill is a database-operations guide whose powerful actions are mostly disclosed, but its broad activation scope and incomplete safety gating make it something users should review carefully before using on real databases.
Use this only when you intentionally want an agent to help with database administration. Before enabling it against any real database, require a dry run, verified backups, explicit target-environment naming, least-privilege credentials, and human approval for migrations, sync scripts, failover, recovery, offsite backup sync, or webhook alerts.
The skill declares at one point that it needs exec capability for some features, then later reclassifies itself as pure Markdown-only. That inconsistency can mislead a host agent or reviewer about whether command execution may occur, weakening trust boundaries and potentially causing unsafe invocation in environments that apply different safeguards based on classification.
The trigger language is extremely broad and maps to generic database-related development scenarios, which increases the chance the skill will be auto-invoked for requests beyond its safe scope. In a skill with write and exec-adjacent database operations, overbroad routing raises the likelihood of unintended destructive guidance or execution paths.
The coverage keywords include vague invocation phrases such as general database operation and storage-management needs, without meaningful scope limits. Because the skill describes migration, sync, backup, and HA workflows, broad matching can cause it to activate in contexts where users did not intend potentially impactful operational advice.
The skill documents schema migration and synchronization capabilities, including operations that can alter or remove production database structures, without a prominent upfront warning about destructive impact. In a database-operations skill, omission of strong safety gating is especially dangerous because users may apply examples directly to live systems and cause outages, data loss, or irreversible schema drift.
The skill describes syncing backups to S3 and sending monitoring alerts to webhooks without clearly warning that database metadata, operational events, or backup artifacts may leave the local environment. This is risky because operators may enable external transmission without considering data sensitivity, retention, compliance, or credential exposure in enterprise contexts.
No suspicious patterns detected.
