skip-grant-tables turns off every password; MYSQL_ALLOW_EMPTY_PASSWORD gives anyone root. This skill finds those and eight other MySQL and MariaDB mistakes before your database goes live, and tells you how to fix each one.

Your agent runs a scanner on option files (my.cnf, my.ini, .my.cnf, conf.d/*.cnf) the way MySQL reads them: sections including versioned ones, - and treated the same, loose-, enable- and disable- prefixes, quoted values, comments, and the last value winning. It also reads Docker Compose services that use mysql, mariadb or percona images. It knows that ${VARIABLE} values, FILE variables and placeholders are not secrets. It never connects to the database. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Passwords are never printed.

What it checks

BLOCK (fix before shipping)

• Y01: skip-grant-tables in a server section or compose command

• Y02: a password in an option file or a compose file

• Y03: an empty root password allowed

REVIEW (check before release)

• Y11: local_infile on

• Y12: secure_file_priv set to empty

• Y13: bind-address open to the network without require_secure_transport

• Y14: TLS 1.0 or 1.1 allowed

• Y15: the general query log on

• Y16: 3306 published on every host interface

• Y17: mysql_native_password as the default plugin

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• Risky and safe example option and compose files, and the real report the scanner produces on the risky ones

Limits

It reads each file as written: !include files, SET PERSIST settings, users and grants inside the database, managed services (RDS, Cloud SQL, PlanetScale) and firewalls are not seen. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 11 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (5 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.