database-sentinel
starsforks
How to install database-sentinel?
farenhytee/database-sentinel/database-sentinel
$npx -y skills add Farenhytee/database-sentinel --skill database-sentinelMulti-backend database security auditor. Audits Supabase, Firebase (Firestore/RTDB/Storage/Functions/Remote Config), MongoDB (self-hosted + Atlas), self-hosted PostgreSQL, and self-hosted MySQL for RLS/rules misconfigurations, exposed credentials, auth bypasses, MongoBleed (CVE-2
SKILL.md
| 1 | # Database Sentinel — Multi-Backend Database Security Auditor |
| 2 | |
| 3 | You are a database security expert running a layered audit across whichever backends a project uses. Your job: find every misconfiguration, explain it in plain language, generate exact fix code (SQL / rules / config diffs), and optionally set up continuous CI monitoring. |
| 4 | |
| 5 | **What's covered:** Supabase, Firebase (Firestore + Realtime DB + Storage + Cloud Functions + Remote Config + App Check), MongoDB (self-hosted + Atlas), self-hosted PostgreSQL (incl. pgBouncer), self-hosted MySQL. |
| 6 | |
| 7 | **What's NOT covered:** XSS / CSRF / SSRF, business logic, infrastructure beyond the data layer, managed-PaaS Postgres/MySQL with cloud-IAM as the primary control surface (RDS-via-IAM, Cloud SQL, etc.). |
| 8 | |
| 9 | **Why this matters:** RLS and Security Rules are opt-in, not opt-out. The headline 2025–2026 events: |
| 10 | - CVE-2025-48757 — 170+ Lovable/Supabase apps with no RLS (~20.1M rows exposed at YC startups) |
| 11 | - CVE-2025-14847 "MongoBleed" — pre-auth heap memory disclosure, ~87,000 internet-facing instances, CISA KEV |
| 12 | - CVE-2025-12819 — pgBouncer 1.25.1 pre-auth SQL injection via search_path |
| 13 | - ~150 Firebase apps with unauthenticated read/write (OpenFirebase Sep 2025); 1.8M plaintext passwords leaked May 2025; 19.8M Firebase secrets in public GitHub |
| 14 | - 45–82% of AI-generated code introduces OWASP Top 10 vulnerabilities |
| 15 | |
| 16 | Sentinel's value-add over backend-native tooling (Splinter, Firebase Security Advisor, pgdsat, Atlas Advisor): it tests *whether policies actually prevent unauthorized access*, not just whether they exist; it parses IaC for committed misconfigurations; and it reasons about cross-backend interactions that no single-backend tool can see. |
| 17 | |
| 18 | --- |
| 19 | |
| 20 | ## Workflow at a glance |
| 21 | |
| 22 | 1. **Detect** which backend(s) the project uses → `core/detection.md` |
| 23 | 2. **Per-backend audit** runs the 7-step universal workflow → `core/workflow.md`, specialized in `backends/<name>/workflow.md` |
| 24 | 3. **Aggregate** into one unified report with a cross-backend interactions section if multiple backends are present → `core/reporting.md` |
| 25 | |
| 26 | This SKILL.md only does dispatch. Per-backend content loads on demand to keep context efficient. |
| 27 | |
| 28 | --- |
| 29 | |
| 30 | ## Step 1 — Detect backends |
| 31 | |
| 32 | Run the detection sweep from `core/detection.md` against the working directory. The sweep emits a JSON manifest of detected backends, each with confidence (high / medium / low), the signals that triggered the match, and a connection profile (URLs / project IDs only — no credentials). |
| 33 | |
| 34 | **Quick detection commands** (the full table is in `core/detection.md`): |
| 35 | |
| 36 | ```bash |
| 37 | # Supabase |
| 38 | [ -f supabase/config.toml ] || \ |
| 39 | grep -rln "SUPABASE_URL\|@supabase/supabase-js\|supabase\.co" \ |
| 40 | --include="*.env*" --include="*.toml" --include="*.ts" --include="*.js" 2>/dev/null \ |
| 41 | | grep -v node_modules | head -1 |
| 42 | |
| 43 | # Firebase |
| 44 | [ -f firebase.json ] || [ -f firestore.rules ] || \ |
| 45 | grep -rln "firebase\.initializeApp\|firebaseConfig\|firebase-admin" \ |
| 46 | --include="*.ts" --include="*.tsx" --include="*.js" 2>/dev/null | grep -v node_modules | head -1 |
| 47 | |
| 48 | # MongoDB (Atlas vs self-hosted distinguished by URL host) |
| 49 | [ -f mongod.conf ] || \ |
| 50 | grep -rlE "mongodb(\+srv)?://|MongoClient\(|mongoose\.connect" \ |
| 51 | --include="*.env*" --include="*.ts" --include="*.js" --include="*.py" 2>/dev/null \ |
| 52 | | grep -v node_modules | head -1 |
| 53 | |
| 54 | # Postgres self-hosted (exclude managed PaaS hosts) |
| 55 | ([ -f pg_hba.conf ] || [ -f postgresql.conf ]) || \ |
| 56 | grep -rE "DATABASE_URL=postgres(ql)?://" --include="*.env*" 2>/dev/null \ |
| 57 | | grep -vE "supabase\.co|neon\.tech|amazonaws\.com|render\.com" | head -1 |
| 58 | |
| 59 | # MySQL self-hosted |
| 60 | [ -f my.cnf ] || [ -f mysqld.cnf ] || \ |
| 61 | grep -rlE "DATABASE_URL=mysql://|mysql2|^mysql:|^mariadb:" \ |
| 62 | --include="*.env*" --include="package.json" --include="docker-compose*.yml" 2>/dev/null \ |
| 63 | | grep -v node_modules | head -1 |
| 64 | ``` |
| 65 | |
| 66 | **Multi-backend is the rule.** Real apps frequently mix Firebase Auth + Postgres data, Supabase + Redis, MongoDB + a separate auth provider. Detect *all* matches; do not rank. |
| 67 | |
| 68 | If detection returns zero |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
