Qdrant ignores QDRANT_API_KEY on the server (it reads only QDRANT__SERVICE__API_KEY), a Weaviate config that adds API keys but leaves anonymous access set to 'true' still lets anyone in, and Docker publishes "6333:6333" on every interface. Any one of these leaves every document you indexed open to whoever finds the port. This skill finds those and the other vector database mistakes below before you deploy, and tells you how to fix each one.

Your agent runs a scanner on Docker Compose files, Kubernetes manifests, Helm values for the Weaviate, Qdrant and Milvus charts, Qdrant, Milvus and Chroma server configs, .env files, and Python, JavaScript and TypeScript client code (including Pinecone clients and LangChain and LlamaIndex vector stores). It knows each server's real setting names and defaults, treats ${VAR} references and Kubernetes secretKeyRef values as configured, gives local quickstart Compose files REVIEW rather than BLOCK, and never connects to a database. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• V01: a database whose missing authentication the file shows, behind a public LoadBalancer (Kubernetes Service or Helm values)
• V02: authentication the server ignores: Weaviate anonymous access left on beside API keys, anonymous admins, switches set to 'yes', QDRANT_API_KEY on the Qdrant container, legacy auth settings on Chroma 1.x
• V03: API keys, passwords and tokens written in Compose, Kubernetes, Helm values, server configs, settings modules or client code, including Weaviate module keys such as OPENAI_APIKEY (SOPS-encrypted values are skipped)
• V04: the default Milvus root login (root with the password Milvus) sent to a public host

REVIEW (check before release)

• V11: an unauthenticated database port published on every interface, a load balancer whose scope is unclear, or Helm values that rely on the chart's default of no authentication
• V12: plain HTTP or certificate checks turned off when connecting to a remote database
• V13: Chroma's reset endpoint turned on
• V14: anonymous read access, or every API key user an admin, in Weaviate
• V15: database images on a moving tag (latest-style or no tag)
• V16: Qdrant's cluster port 6335 or Weaviate's profiling port 6060 published
• V17: the default Milvus root password probably still in use (root:Milvus to an internal host, or authorization turned on without a new root password)

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official source for each rule
• A risky and a safe example RAG project (Compose, Kubernetes, .env and Python), and the real report the scanner produces on the risky one

Limits

It reads each file on its own: a Kubernetes Service is matched only with workloads in the same file, Helm templates are not rendered, and files named by env_file or mounted as server config are not opened, so auth set there counts as unknown. A host counts as remote when it is a public IP or ends in a public top-level domain. Ingress authentication, network policies and cloud firewalls are not known, and Dockerfiles, notebooks and Terraform are not read. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 23 files: SKILL.md, the scanner in scripts/ (8 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (12 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.