db

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

export VAULT_ADDR="http://127.0.0.1:8200"

Migration processes often require elevated privileges, creating security risks if not properly managed:

Jobs run with the privileges of their owner schema. A job owned by `APPSCHEMA` cannot call `DBMS_STATS.GATHER_DATABASE_STATS` unless `APPSCHEMA` has the `ANALYZE ANY` privilege. Create DBA-owned jobs

**Security implication**: The calling user can perform actions they do not have direct privileges for. This is by design for controlled APIs, but becomes a risk if the procedure has SQL injection vuln

[ ] Definer rights procedures do not grant callers elevated privileges unintentionally

-- Allow DBAs unrestricted access

**Agent rule**: If a user says "update all employees" or "delete old records" without specifying which rows — ask for clarification before generating SQL. See `intent-disambiguation.md`.

**Generating DELETE without WHERE** — even if a user says "clear the table", always confirm and use DELETE with an explicit `WHERE 1=1` so the agent generated an intentional, auditable statement.

ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY <wallet_password>;

When the database is configured for OCI resource principal access, use the reserved credential name `OCI$RESOURCE_PRINCIPAL` in the profile. You do not create that credential with `DBMS_CLOUD.CREATE_C

1. **Credential exposure:** Fixed user links store the remote password in an encrypted but accessible form in `SYS.LINK$`. A DBA with `SELECT ANY DICTIONARY` access can potentially extract link creden

- **Use client credentials for all service-to-service calls**: Never hardcode DB credentials in client applications. Use OAuth2 client credentials so you can revoke access without changing DB password

cat > passwords.txt <<EOF

Add to crontab:

# 3. Update PATH to point to new version

Audit 0.4.1 · source sha 1d5e869fce7a · 21 Oct 2026Report an issue or request a re-scan

• Publisheroracle GitHub organizationOwner of the repository this skill is read from
• Source folderoracle/skills/dbThe exact folder we audited
• LicenceUPL-1.0As the repository states it
• Commit pinned for this verdict1d5e869fce7aA new audit runs when the source changes
• Repository statusNot archivedLast push 12 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Oracle Database guidance for SQL, PL/SQL, SQLcl, ORDS, Oracle Vector SDK, administration, app development, performance, security, migrations, and agent-safe database workflows. Use when the user asks to write, edit,…

---
name: db
description: Oracle Database guidance for SQL, PL/SQL, SQLcl, ORDS, Oracle Vector SDK, administration, app development, performance, security, migrations, and agent-safe database workflows. Use when the user asks to write, edit, rewrite, review, format, debug, tune, or explain SQL; create or refactor PL/SQL; use Oracle VecDB through the Python SDK, REST API, or DBMS_VECTOR_DATABASE package; use SQLcl, Liquibase, ORDS, JDBC, node-oracledb, Python, Java, .NET, or database frameworks; troubleshoot vector tables, embeddings, vector search, reranking, queries, sessions, locks, waits, indexes, optimizer plans, AWR, ASH, migrations, schemas, users, roles, privileges, backup, recovery, Data Guard, RAC, multitenant, containers, monitoring, auditing, encryption, VPD, or safe agent database operations.
---

# Oracle Database Skills

This domain contains Oracle Database skills for administration, SQL and PL/SQL development, performance tuning, security, ORDS, SQLcl, migrations, frameworks, VecDB SDK/REST/PL/SQL workflows, OCR container guidance, and agent-safe database workflows.

## How to Use This Domain

1. Start with the routing table below.
2. Read only the specific file or category you need.

## Directory Structure

```text
db/
├── admin/
├── agent/
├── appdev/
├── architecture/
├── backup-recovery/
├── containers/
├── design/
├── devops/
├── data-guard/
├── features/
├── frameworks/
├── migrations/
├── monitoring/
├── ords/
├── performance/
├── plsql/
├── security/
├── sql-dev/
├── sqlcl/
└── vecdb/
```

## Category Routing

| Topic | Directory |
|-------|-----------|
| Data Guard, redo/undo logs, users | `db/admin/` |
| Safe DML, destructive operation guards, idempotency, schema discovery, ORA- error handling | `db/agent/` |
| JDBC, JDBC Extensions, Python, .NET, pooling, JSON, XML, spatial, Oracle Text, transactions, MLE, language drivers | `db/appdev/` |
| RAC, Multitenant, Exadata, In-Memory, OCI database services, Data Guard architecture | `db/architecture/` |
| Backup, recovery, RMAN, Autonomous Recovery Service, Cloud Protect | `db/backup-recovery/` |
| OCR database-category container images and pull guidance | `db/containers/` |
| ERD, data modeling, partitioning, tablespaces | `db/design/` |
| Schema migrations, online operations, edition-based redefinition, testing, version control | `db/devops/` |
| Guidance and assistance for triaging data guard configuration and environment related issues | `db/data-guard/` |
| AQ, DBMS_SCHEDULER, materialized views, DBLinks, APEX, vector search, SELECT AI | `db/features/` |
| SQLAlchemy, Django, Pandas, Spring JPA, MyBatis, TypeORM, Sequelize, Dapper, GORM | `db/frameworks/` |
| Migrations from PostgreSQL, MySQL, SQL Server, MongoDB, Snowflake, and more | `db/migrations/` |
| Alert log, ADR, health monitor, space management, top SQL | `db/monitoring/` |
| ORDS architecture, installation, REST design, authentication, monitoring, ORDS Concert Sample App | `db/ords/` |
| AWR, ASH, explain plan, indexes, optimizer stats, wait events, memory | `db/performance/` |
| Package design, error handling, performance, collections, cursors, debugging | `db/plsql/` |
| Privileges, Deep Data Security, VPD, masking, auditing, encryption, network security | `db/security/` |
| SQL tuning, SQL patterns, dynamic SQL, injection avoidance | `db/sql-dev/` |
| SQLcl basics, scripting, Liquibase, formatting, DDL generation, data loading, MCP server, scheduler daemon, AWR, background jobs, schema comparison with DIFF | `db/sqlcl/` |
| Oracle Vector SDK setup and configuration, including database preparation, Python SDK, REST API, PL/SQL package, version prerequisites, vector tables, ingestion, models, search, reranking, indexes, and jobs | `db/vecdb/` |

## Key Starting Points

- `db/sqlcl/sqlcl-mcp-server.md`
- `db/migrations/migration-assessment.md`
- `db/performance/explain-plan.md`
- `db/plsql/plsql-package-design.md`
- `db/appdev/java-oracle-jdbc.md`
- `db/devops/schema-migrations.md`
- `db/security/deep-data-security.md`
- `db/agent/schema-discovery.md`
- `db/containers/container-selection-matrix.md`
- `db/backup-recovery/autonomous-recovery-service.md`
- `db/backup-recovery/cloud-protect.md`
- `db/vecdb/vecdb-provisioning.md`
- `db/vecdb/vecdb-architecture.md`

## Common Multi-Step Flows

| Task | Recommended Sequence |
|------|----------------------|
| Diagnose a slow query | `explain-plan` → `wait-events` → `optimizer-stats` → `awr-reports` |
| Plan a migration | `migration-assessment` → `oracle-migration-tools` → source-specific `migrate-*.md` → `migration-cutover-strategy` |
| Build RAG on Oracle Database | `ai-profiles` → `vector-search` → `dbms-vector` |
| Build a Java JDBC service | `java-oracle-jdbc` → `java-oracle-jdbc/dependencies` → `java-oracle-jdbc/connections` → `java-oracle-jdbc/sql` → `java-oracle-jdbc/pooling-production` → `java-oracle-jdbc/providers` (cloud secrets, tracing, Spring, Pkl) |
| Perform agent-safe schema change | `schema-discovery` → `destructive-op-guards` → `idempotency-patterns` → `schema-migrations` |
| Set up AI-driven database access via MCP | `security/deep-data-security` (end-user authorization) → `sqlcl-basics` (save connections) → `sqlcl-mcp-server` (configure + start) |
| Set up an Oracle Vector SDK database deployment | `vecdb-provisioning` → Oracle Vector SDK Quick Start → **Prepare an AI Database** |
| Build vector-based applications for semantic search, RAG, or recommendations using Oracle Vector SDK's fixed-schema APIs through the Python SDK, REST, or PL/SQL | `vecdb-architecture` → `vecdb-api-reference` → relevant capability file (`vecdb-models`, `vecdb-vector-tables`, `vecdb-search`, or `vecdb-indexes`) |

Excerpt, first 5,694 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-21
   ✓SAFE B 89 / 100

   first audit · source 1d5e869fce7a

Questions about db

• github.com/oracle/skills/tree/main/db — the audited source at commit 1d5e869fce7a and every finding aboveObserved · 21 Oct 2026

Spotted something wrong? Report a correction · Methodology