What Does This Skill Do?
/pg-security is a multi-tool workflow that calls four security tools in sequence and produces a complete security report. From transport encryption to authentication rules to privilege escalation — the skill covers the entire attack surface of a PostgreSQL instance.
Workflow Phases
- Phase 1 — SSL/TLS:
pg_ssl_auditchecks certificates, protocol versions, and cipher suites - Phase 2 — pg_hba Rules:
pg_hba_analyzeidentifies insecure authentication rules (trust, md5, open networks) - Phase 3 — Password Policies:
pg_password_policy_checkchecks password requirements and expiring passwords - Phase 4 — Privilege Escalation:
pg_privilege_escalation_checkfinds paths through which roles could unintentionally gain superuser access - Phase 5 — Security Score: All results feed into a weighted score from 0 to 100
How Is It Called?
Connecting First
Every skill starts with a database connection. The enterprise platform supports multiple profiles — ideal for multi-cluster setups:
▶ Calling tools...
→ pg_connect { "profile": "production-db" }
{
"status": "connected",
"database": "mcp_test",
"version": "PostgreSQL 16.x",
"host": "db.example.com"
}
Claude CLI (Natural Language)
▶ Calling tools...
→ Phase 1/5: pg_ssl_audit {}
SSL enabled: ✓
Protocol: TLSv1.3, Cipher: TLS_AES_256_GCM_SHA384
Certificate: valid until 2027-01-15 (296 days)
Client certificates: not enforced
→ Phase 2/5: pg_hba_analyze {}
12 rules analyzed, 3 issues found:
→ host all all 0.0.0.0/0 md5 — open network with weak auth
→ local all postgres trust — superuser without password
→ host replication all 10.0.0.0/8 md5 — broad replication access
→ Phase 3/5: pg_password_policy_check {}
8 roles checked:
→ 2 roles without password expiry (db_admin, db_analyst)
→ 1 role with password older than 180 days (app_service)
→ Phase 4/5: pg_privilege_escalation_check {}
1 escalation path found:
→ db_analyst → MEMBER OF db_admin → SUPERUSER
→ db_analyst can gain superuser via role membership
→ Phase 5/5: Security Score
╔══════════════════════════════════════════╗
║ Security Score: 61 / 100 ║
╠══════════════════════════════════════════╣
║ SSL/TLS : TLSv1.3 ✓ ║
║ pg_hba Issues : 3 insecure rules ║
║ Password Policy : 3 violations ║
║ Privilege Escal. : 1 path ║
║ Verdict : ACTION REQUIRED ║
╚══════════════════════════════════════════╝
MCP Protocol (Skill Definition)
const result = await client.callTool("/pg-security", {});
// Response:
{
"skill": "/pg-security",
"tools": [
"pg_ssl_audit",
"pg_hba_analyze",
"pg_password_policy_check",
"pg_privilege_escalation_check"
],
"phases": 5,
"output": {
"score": 61,
"ssl": { "enabled": true, "protocol": "TLSv1.3", "cert_days_remaining": 296 },
"hba_issues": 3,
"password_violations": 3,
"escalation_paths": 1,
"recommendations": [
"Replace md5 with scram-sha-256 in pg_hba.conf",
"Remove trust auth for local superuser",
"Restrict replication to specific IPs",
"Set password expiry for db_admin, db_analyst",
"Revoke db_analyst membership in db_admin"
]
}
}
What Happens Under the Hood?
The skill runs four audit tools and aggregates results in a fifth step:
Phase 1: SSL/TLS Audit
Checks ssl parameters in pg_settings, reads certificate information from pg_stat_ssl, and evaluates protocol version and cipher strength. TLSv1.2 with ECDHE is the minimum; TLSv1.3 is optimal.
Phase 2: pg_hba Analysis
Parses effective pg_hba.conf rules from pg_hba_file_rules (PG 15+) and rates each rule by risk: trust = critical, md5 = medium, scram-sha-256 = secure, cert = optimal.
Phase 3: Password Policies
Checks pg_authid for roles without password expiry (rolvaliduntil IS NULL) and roles with stale passwords. Recommends ALTER ROLE ... VALID UNTIL for all service accounts.
Phase 4: Privilege Escalation
Traverses the role graph via pg_auth_members and finds paths through which unprivileged roles can transitively gain superuser access. Each path found is a critical finding.
Phase 5: Scoring
Weighted formula:
- 25% — SSL/TLS (protocol, cipher, certificate)
- 30% — pg_hba (insecure rules)
- 20% — Password policies (expiry, strength)
- 25% — Privilege escalation (critical paths)
Pro Tip: Run the security audit after every pg_hba.conf change. The trust mode for local superuser connections is common in development but a critical risk in production.
What Does the Test Suite Validate?
The test suite validates the complete security workflow against a PostgreSQL instance with a typical enterprise configuration:
Test Files 1 passed (1)
Tests 1 passed (1)
Duration 1.4s
Test Data Scenario
The test instance contains:
- pg_hba.conf — 12 rules including deliberately insecure entries (trust, md5, open networks)
- SSL certificate — Self-signed for test environment, TLSv1.3
- 8 roles — postgres (superuser), db_admin, db_analyst, app_service, replicator, readonly, backup, monitoring
- Role memberships — db_analyst as member of db_admin (escalation path)
Summary
/pg-security covers the four most critical attack vectors of a PostgreSQL instance: transport, authentication, passwords, and privileges. The security score makes improvements measurable — and the skill provides a concrete recommendation for every finding.