oracle-db-skills

kubeconfig_path="${kubeconfig_arg:-$HOME/.kube/config}"

Why

touches a credential store

Fix

—

kubeconfig_path="$HOME/.kube/config"

Why

touches a credential store

Fix

—

kubeconfig_path="${kubeconfig_arg:-$HOME/.kube/config}"

Why

touches a credential store

Fix

—

- [plugin-variants/openDoorCredentials](assets/app/authentication/plugin-variants/open-door-credentials/open-door-credentials.md) — Enables anyone to access your application. Enter any identifier that

Why

asks the agent to read credentials

Fix

—

- [plugin-variants/openDoorCredentials](assets/app/authentication/plugin-variants/open-door-credentials/open-door-credentials.md) — Enables anyone to access your application. Enter any identifier that

Why

asks the agent to read credentials

Fix

—

parameter-c2.md

Why

member named after an attack tool

Fix

remove or justify

action-c2.md

Why

member named after an attack tool

Fix

remove or justify

column-c2.md

Why

member named after an attack tool

Fix

remove or justify

column-group-c2.md

Why

member named after an attack tool

Fix

remove or justify

saved-report-c2.md

Why

member named after an attack tool

Fix

remove or justify

if not eval(expr, {"obj": obj}):

Why

evaluates text as code

Fix

remove; use a parser or a dispatch table

const repoRoot = path.resolve(moduleDir, "../../../..");

Why

No further detail recorded for this rule.

Fix

—

rootPath: path.resolve(MODULE_DIR, "../../../..")

Why

No further detail recorded for this rule.

Fix

—

: path.resolve(path.dirname(SCRIPT_PATH), "../../..");

Why

No further detail recorded for this rule.

Fix

—

export VAULT_ADDR="http://127.0.0.1:8200"

Why

No further detail recorded for this rule.

Fix

—

decoded = base64.b64decode(entry["auth"]).decode("utf-8")

Why

No further detail recorded for this rule.

Fix

—

- [plugin-variants/openDoorCredentials](assets/app/authentication/plugin-variants/open-door-credentials/open-door-credentials.md) — Enables anyone to access your application. Enter any identifier that

Why

No further detail recorded for this rule.

Fix

—

- [plugin-variants/openDoorCredentials](assets/app/authentication/plugin-variants/open-door-credentials/open-door-credentials.md) — Enables anyone to access your application. Enter any identifier that

Why

No further detail recorded for this rule.

Fix

—

Migration processes often require elevated privileges, creating security risks if not properly managed:

Why

No further detail recorded for this rule.

Fix

—

Jobs run with the privileges of their owner schema. A job owned by `APPSCHEMA` cannot call `DBMS_STATS.GATHER_DATABASE_STATS` unless `APPSCHEMA` has the `ANALYZE ANY` privilege. Create DBA-owned jobs

Why

No further detail recorded for this rule.

Fix

—

**Security implication**: The calling user can perform actions they do not have direct privileges for. This is by design for controlled APIs, but becomes a risk if the procedure has SQL injection vuln

Why

No further detail recorded for this rule.

Fix

—

**Agent rule**: If a user says "update all employees" or "delete old records" without specifying which rows — ask for clarification before generating SQL. See `intent-disambiguation.md`.

Why

No further detail recorded for this rule.

Fix

—

**Generating DELETE without WHERE** — even if a user says "clear the table", always confirm and use DELETE with an explicit `WHERE 1=1` so the agent generated an intentional, auditable statement.

Why

No further detail recorded for this rule.

Fix

—

- `type` — `<STRING>`; —; Yes; —; `<enum:[custom:"Custom", custom:"Custom", databaseAccounts:"Database Accounts", databaseAccounts:"Database Accounts", httpHeaderVariable:"HTTP Header Variable", httpH

Why

asks the agent to read credentials

Fix

—

- `type` — `<STRING>`; —; Yes; —; `<enum:[openDoorCredentials:"Open Door Credentials"]>`; —; —;

Why

asks the agent to read credentials

Fix

—