skills.rest
envoydev
envoydevCOMMUNITY
Explore all skills by this author →
GitHub

database-security

Reviews SQL and data-persistence layers for injection, privilege, tenant-isolation, and secret-handling risks.

1|Updated Jun 2, 2026
Search Tags:#sql injection#database security#row-level security#ef core#least privilege#tenant isolation#connection strings
One-click install
npx skills add https://github.com/envoydev/claude-stack --skill database-security-envoydev
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: database-security
Source: https://github.com/envoydev/claude-stack/tree/main/stack/skills/database-security
Command: npx skills add https://github.com/envoydev/claude-stack --skill database-security-envoydev

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Databases are the last line of defense, and a single app-layer bug can become a full-table breach when the data layer itself is not hardened. This Skill gives you a structured threat-surface map for reviewing SQL and persistence code so injection sinks, over-privileged logins, cross-tenant reads, and leaked secrets are found and fixed before they ship. ## Core Features & Use Cases - Injection sink audit: Checks EF Core raw SQL APIs, ADO.NET commands, dynamic SQL in stored procedures, and client-driven ORDER BY clauses for string-concatenated input. - Least-privilege and tenant isolation review: Verifies runtime logins are not db_owner or superuser, and that Row-Level Security policies or EF Core global query filters enforce tenant boundaries instead of remembered WHERE clauses. - Secrets, encryption, and audit checks: Flags plaintext connection-string passwords, TrustServerCertificate=true in production, missing at-rest encryption for sensitive columns, and audit records that store the secret they track. - Use Case: During a security sweep of a multi-tenant ASP.NET API, ask whether one tenant can read another's rows; the Skill probes RLS policy counts and runtime login grants, then reports findings as surface | risk | fix ordered by risk. ## Quick Start Ask the AI to review this repository's data layer for SQL injection, tenant isolation, and connection-string secret handling using the database-security skill.

Frequently Asked Questions about database-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in EF Core raw queries?▼

Use FromSqlInterpolated or FromSql, which turn each interpolated value into a DbParameter. Never pass a concatenated string to FromSqlRaw or ExecuteSqlRaw, and validate table or column identifiers against an allowlist since they cannot be parameterized.

How to enforce tenant isolation in a multi-tenant database?▼

Enforce the tenant filter where it cannot be forgotten: Row-Level Security policies in SQL Server or PostgreSQL keyed to a session tenant id, or an EF Core global query filter via HasQueryFilter. A manually remembered WHERE TenantId clause will eventually be missed.

Is dynamic SQL in a stored procedure safe from injection?▼

No, a stored procedure is not a safe boundary by itself. Build dynamic SQL with sp_executesql on SQL Server or EXECUTE ... USING on PostgreSQL passing parameters, never EXEC on a concatenated string.

Why is TrustServerCertificate=true a security risk in production?▼

TrustServerCertificate=true disables the TLS certificate validation that Encrypt=true provides, opening the connection to a man-in-the-middle attack. Keep Encrypt=true and remove TrustServerCertificate in production connection strings.

When should I not load the database-security review?▼

Do not use it for non-security work such as ordinary query writing or schema design. App-layer EF and access-control findings route to the application-security skill, and migration mechanics route to the migration workflow skill.

Related Skills

Explore More Software Engineering Skills→
gabrielnsmntogabrielnsmnto
3

db-rollback

Restores a PostgreSQL database to a previous snapshot or executes a rollback script.

Community
Advanced
shahdanishshahdanish

authentication

Implement JWT bearer authentication and authorization policies in ASP.NET Core.

Community
Advanced
bowlnebabowlneba

ddd-clean-architecture

Implement DDD and clean architecture layers in ASP.NET Core Web APIs.

Official
Advanced
Mo7amed-MahmoudMo7amed-Mahmoud

security_scan

Run parallel dependency, static, and privacy scans and emit severity findings.

Community
Advanced