Network Data Services

Name: Network Data Services
Author: sodejm

ASecurity

Assess databases (MySQL, Postgres, MSSQL, Oracle), NoSQL/document stores (MongoDB, CouchDB, Cassandra), caches (Redis, Memcached), and search/analytics engines (Elasticsearch, InfluxDB, Kibana, Splunk) with bounded query budgets, synthetic canary verification, cleanup receipts, and data privilege candidate routing.

2 stars
0 votes
0 copies
0 views
Added October 15, 2026

securitypythongobashsqlapidatabase

Works with

Security analysis

A100/100

Scanned October 15, 2026

npx -y skills add sodejm/copilot-operation-plugin-for-security --skill network-data-services --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Network Data Services?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Network Data Services

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/sodejm-network-data-services-copilot-operation-plugin-for-s/badge)](https://www.skillsdirectory.com/skills/sodejm-network-data-services-copilot-operation-plugin-for-s)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: network-data-services
description: Assess databases (MySQL, Postgres, MSSQL, Oracle), NoSQL/document stores (MongoDB, CouchDB, Cassandra), caches (Redis, Memcached), and search/analytics engines (Elasticsearch, InfluxDB, Kibana, Splunk) with bounded query budgets, synthetic canary verification, cleanup receipts, and data privilege candidate routing.
---

# Databases, Caches, and Search Services

1. **Protocol-Specific Database, Cache, and Search Probes**:
   - Assess exposure of relational databases (MySQL, Postgres, MSSQL, Oracle), NoSQL/document stores (MongoDB, CouchDB, Cassandra), caches (Redis, Memcached), and search/analytics engines (Elasticsearch, InfluxDB, Kibana, Splunk) across approved targets.
   - Ground assessments in observed protocol responses, versions, and configurations.

2. **Bounded Query Budgets & Zero Bulk Extraction**:
   - Enforce bounded query budgets (default 5 rows/documents) to verify schema, table/collection presence, and access controls.
   - Prohibit and block bulk data dumps, full collection scans, and unconstrained production record retrieval.

3. **Authentication Prerequisites & Data Privilege Routing**:
   - Determine whether services require authentication (`none`, `anonymous`, `default_credentials`, `user_password`, `client_cert`, `token_or_api_key`, `kerberos`, `unknown`).
   - Extract `DataPrivilegeCandidate` entries for lateral movement and database takeover workflows.

4. **Canary Validation and Verifiable Cleanup Receipts**:
   - Validate access controls using benign canary identifiers (`canary_audit_table`, `canary_cache_key`) without modifying production data.
   - Emit verified `CleanupReceipt` records confirming rollback and artifact removal (`verified_removed`).

5. **Inaccessible != Secure Truth Boundary**:
   - Strictly mark unreachable, filtered, or connection-refused services as `inaccessible` (with `auth_prerequisite: unknown`). Never claim unverified services are protected or secure.

6. **CLI Invocation**:
   ```bash
   python3 -m cops data-services assess --targets db01.corp.internal --canary-id "canary_audit_table" --output data_report.json
   python3 -m cops data-services candidates data_report.json --output data_candidates.json
   python3 -m cops data-services cleanup data_report.json --output cleanup_receipts.json
   python3 -m cops data-services inspect data_report.json
   ```