database-security
Database security auditor specialized in Row Level Security (RLS) enforcement, Zero-Trust database architecture, and forensic audit trails. Covers Supabase RLS policies, Postgres security, Convex auth guards, PGAudit configuration, JIT access controls, and database-specific compliance validation. Use when auditing database access policies, implementing RLS in Supabase or Postgres, configuring Convex auth guards, setting up audit logging, reviewing database security, or validating database-level compliance requirements.
- Installs
- 191
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/oakoss/agent-skills --skill database-security- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads database-security automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Security Audit
Database security auditor specialized in Row Level Security (RLS) enforcement, Zero-Trust database architecture, and forensic audit trails. Focuses on Supabase, Postgres, and Convex data layer security. For general application security (OWASP Top 10, auth patterns, security headers, input validation), use the security skill instead.
Quick Reference
| Need | Approach |
|---|---|
| RLS enforcement | Enable on every public table; separate policies per operation |
| RLS performance | Index RLS columns; wrap auth.uid() in (select ...) subselect |
| Zero-Trust DB | Micro-segmentation, identity propagation, TLS enforcement |
| Supabase auth in RLS | Use (select auth.uid()) and auth.jwt(); never auth.role() |
| Convex auth guards | Call ctx.auth.getUserIdentity() in every public function |
| JIT access | Time-bound grants that expire automatically |
| Audit trails | Database triggers with immutable audit_log table |
| PGAudit | Extension for statement-level and object-level SQL auditing |
| Service role safety | Never use service_role key in client-side code |
| Views and RLS | Use security_invoker = true (Postgres 15+) to enforce RLS |
| Schema segmentation | Separate public, private, and audit schemas |
| Database compliance | RLS + audit logging + encryption satisfies multiple frameworks |
Audit Protocol
Follow this sequence when performing a database security audit:
- Attack Surface Mapping: Identify all entry points to the data layer (public APIs, internal dashboards, AI agents, cron jobs)
- RLS Coverage Check: Query pg_tables to verify every public schema table has RLS enabled and appropriate policies
- Policy Review: Check for logical bypasses, missing WITH CHECK clauses, overly permissive FOR ALL policies
- Service Role Audit: Search client code for service_role key exposure; verify it only appears in server-side code
- Function Audit: Check for security definer functions in exposed schemas and Convex functions missing auth guards
- Access Simulation: Execute queries as anon and authenticated roles to verify enforcement
- View Audit: Verify views use security_invoker = true or are not in exposed schemas
- Audit Trail Verification: Confirm triggers or PGAudit capture all security-relevant operations
- Compliance Validation: Map database controls against applicable regulatory frameworks
Security Principles
| Principle | Database Application |
|---|---|
| Defense in Depth | RLS + application checks + schema segmentation |
| Least Privilege | Minimal GRANT per role; anon gets near-zero access |
| Zero Trust | Verify identity at DB level even for internal requests |
| Secure by Default | RLS enabled on creation; default-deny when no policy |
| Fail Securely | Postgres default-deny on RLS; generic error responses |
| Assume Breach | Design assuming attacker has a valid JWT |
Anti-Patterns
| Anti-Pattern | Risk |
|---|---|
| Security by obscurity (UUIDs only) | Attackers enumerate IDs via IDOR |
| Anon role with SELECT on sensitive tables | Public data exposure via Supabase API |
| RLS columns without indexes | Production performance degradation (100x+) |
| Frontend-only permission checks | Attackers bypass via direct API calls |
| Standing admin privileges | Excessive blast radius if compromised |
| service_role key in client-side code | Bypasses all RLS policies completely |
| FOR ALL policies instead of per-operation | Unintended write access through broad rule |
| Security definer functions in public schema | Functions callable from API, bypass RLS |
| Views without security_invoker | Views bypass RLS silently |
Common Mistakes
| Mistake | Correct Pattern |
|---|---|
| Using auth.uid() = user_id without wrapping in (select ...) | Use (select auth.uid()) = user_id so Postgres caches the result via initPlan |
| Using FOR ALL instead of separate per-operation policies | Create separate SELECT, INSERT, UPDATE, DELETE policies for clarity and safety |
| Leaving anon role with SELECT on sensitive tables | Restrict anon access; require authenticated role for sensitive data |
| Relying on UUIDs as the only access control | Enforce RLS policies and explicit auth checks alongside unique identifiers |
| No index on columns used in RLS USING clauses | Add B-tree indexes on all columns referenced in RLS policy expressions |
| Convex function missing ctx.auth.getUserIdentity() call | Every public query and mutation must validate identity before accessing data |
| Using service_role key in client-side code | Use anon key client-side; service_role only in server-side functions |
| Views bypassing RLS without security_invoker | Set security_invoker = true on views in Postgres 15+ |
| Security definer functions in exposed schemas | Place security definer functions in non-exposed schemas with search_path = '' |
| No audit logging for security-relevant database events | Use triggers and PGAudit to capture all data access and modifications |
Relationship to Security Skill
The application-security skill covers general application security: OWASP Top 10, authentication patterns, input validation, security headers, and compliance overviews. This database-security skill complements it by focusing on database-layer concerns: RLS policy design and performance, Supabase/Postgres-specific patterns, Convex auth guards, PGAudit configuration, and database-specific compliance implementations (SQL functions for GDPR erasure, HIPAA PHI audit triggers, etc.).
Delegation
- Verify RLS enforcement with access simulations: Use
Taskagent to run anonymous and authenticated queries against every public table - Audit Convex functions for missing auth guards: Use
Exploreagent to scan all query and mutation handlers for getUserIdentity calls - Design zero-trust database architecture: Use
Planagent to map schemas, access policies, JIT grants, and audit log design - Generate database compliance evidence: Use
Taskagent to run audit queries and produce compliance reports
References
- rls-performance.md -- RLS policy performance, initPlan caching, stable functions, separate policies, EXPLAIN benchmarking
- zero-trust-database.md -- Micro-segmentation, identity propagation, connection security, JIT access controls
- audit-logging.md -- Trigger-based auditing, PGAudit extension and log classes, log integrity, tamper-proof storage
- convex-security.md -- Identity validation, manual RLS in functions, granular functions, role-based access via JWT claims
- threat-modeling.md -- STRIDE applied to database access, RLS bypass vectors, data layer trust boundaries
- application-security.md -- Service role management, schema exposure, security definer functions, views and RLS
- compliance-frameworks.md -- Database-specific GDPR, HIPAA, SOC2, PCI-DSS requirements and SQL implementations
FAQ
What does the database-security skill do?
Database security auditor specialized in Row Level Security (RLS) enforcement, Zero-Trust database architecture, and forensic audit trails. Covers Supabase RLS policies, Postgres security, Convex auth guards, PGAudit configuration, JIT access controls, and database-specific compliance validation. Use when auditing database access policies, implementing RLS in Supabase or Postgres, configuring Convex auth guards, setting up audit logging, reviewing database security, or validating database-level compliance requirements.
How do I install database-security?
Run npx skills add https://github.com/oakoss/agent-skills --skill database-security in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/database-security/ (personal) or .claude/skills/database-security/ (project).
Which AI agents can use database-security?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is database-security safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains database-security?
It is published by oakoss in oakoss/agent-skills. It has 191 recorded installs.
More from oakoss/agent-skills
ui-ux-polish
oakoss/agent-skills
Iterative UI/UX polishing workflow for web applications. Use when improving visual polish, refining desktop and mobile UX separately, running iterative enhancement cycles, applying design patterns like glassmorphism or bento grids, or auditing accessibility and WCAG compliance. Use for Stripe-level visual quality, responsive optimization, and design system alignment.
playwright
oakoss/agent-skills
Open the skill to read its SKILL.md instructions.
coolify
oakoss/agent-skills
Coolify self-hosted PaaS for deploying applications, databases, and services via REST API and Git integration. Covers API authentication, deployment triggers, build packs (Nixpacks, Dockerfile, Compose), CI/CD with GitHub Actions webhooks, environment management, and Traefik proxy configuration. Use when deploying apps to Coolify, triggering deployments via API, configuring build packs, setting up GitHub Actions CI/CD pipelines, managing environment variables, or troubleshooting deployment failures.
application-security
oakoss/agent-skills
Open the skill to read its SKILL.md instructions.
find-skills
oakoss/agent-skills
Discovers and installs agent skills from the open ecosystem. Enriches search results with descriptions fetched from skills.sh. Use when a user asks "how do I do X", "find a skill for X", "is there a skill that can...", or wants to extend agent capabilities. Use for skill discovery, skill search, skill install, finding tools.
drizzle-orm
oakoss/agent-skills
Open the skill to read its SKILL.md instructions.
Popular data & databases skills
supabase-postgres-best-practices
supabase/agent-skills
Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill BEFORE writing or changing anything that lives in a Postgres database: creating or altering tables and columns (including choosing column types), schema design, migrations and declarative schema files, RLS policies and the tests that verify them, indexes, triggers, database functions, queues and scheduled jobs (pgcron, pgmq), vector/semantic search (pgvector), and restoring dumps (pgrestore) or importing data. Also load it when diagnosing slow queries, high CPU, timeouts, EXPLAIN plans, connection exhaustion, locking, bloat, or rows visible to the wrong user or tenant. This is not just a performance guide — schema, migration, security, and SQL authoring tasks need these rules too, even for a one-column change or a single query.
prisma-client-api
prisma/skills
Prisma Client API reference covering model queries, filters, operators, and client methods. Use when writing database queries, using CRUD operations, filtering data, or configuring Prisma Client. Triggers on "prisma query", "findMany", "create", "update", "delete", "$transaction".
prisma-database-setup
prisma/skills
Deprecated compatibility name for prisma-orm-setup. Use only when a user or existing integration explicitly invokes prisma-database-setup; otherwise select prisma-orm-setup.
prisma-cli
prisma/skills
Prisma ORM 7 CLI reference for existing Prisma 7 applications or explicitly selected Prisma 7 workflows. Covers prisma init, generate, migrate, db, dev, studio, and mcp. For setup, connection repair, or Prisma 8, use prisma-orm-setup; not the Prisma Platform CLI.
prisma-postgres
prisma/skills
Deprecated compatibility name for prisma-postgres-setup. Use only when a user or existing integration explicitly invokes prisma-postgres; otherwise select prisma-postgres-setup.
prisma-driver-adapter-implementation
prisma/skills
Required reference for Prisma ORM 7 SQL driver adapter work. Use when implementing or modifying adapters, adding database drivers, or touching SqlDriverAdapter, Transaction, savepoint, result mapping, or DriverAdapterError behavior. Covers current transaction lifecycle, optional savepoint hooks, original database-error preservation, and verification.