Database security (encryption, access control, injection prevention), data governance (lineage, quality, MDM), and compliance frameworks (GDPR, CCPA, HIPAA)
SkillScore91Maintained
On-demandOn-demand: invoked explicitly — never occupies your agent's context until called.
◆Security & AppSec pack
Last verified 8/16/2026
What it changes
Passed 20 of 22 test cases with the skill, and 18 of 22 without it.
Without skill82%
With skill91%
Checks it passed that the model alone missed
Specifies setting sslmode=require in the PostgreSQL connection string.
Mentions implementing data stewardship roles to manage master entity data.
2 fixed18 passed either way2 still failing0 broke
Pass-rate lift
+9 pp
Tokens
+65%
Agent turns
0%
Response time
-9%
Model gemini-3.6-flashMeasured 8/16/2026v120 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 2
Prompt
Our web application connects to a PostgreSQL instance over TLS. To maximize backward compatibility with legacy internal microservices, developers proposed allowing TLS 1.0 and 1.1 alongside TLS 1.2. Define the mandatory TLS version policy and PostgreSQL connection string parameter required for transit security.
What was checked, without and with the skill
Checked
Without skill
With skill
Requires enforcing TLS 1.2 or higher while disabling TLS 1.0 and 1.1.
Passed
Passed
Specifies setting sslmode=require in the PostgreSQL connection string.
Missed
Passed
case-05 · gemini-3.6-flash · 8/16/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md142 linessingle file
Security and Governance
Defense-in-Depth Security Model
Layered security, each layer provides independent protection:
Encryption at rest (TDE) — protects against physical media theft
Encryption in transit (TLS/SSL) — protects against network interception
Access control (RBAC/ABAC) — enforces least privilege
SQL injection prevention — protects against application-layer attacks
Audit logging — accountability and forensic capability
Encryption at Rest (TDE)
Encrypts DB files on disk without application changes. Encrypts data pages before writing, decrypts on read into memory. AES 128/256-bit symmetric encryption. Transparent to applications.
-- SQL Server TDE (key hierarchy: Service Master Key -> DB Master Key -> Certificate -> DEK)
CREATE DATABASE ENCRYPTION KEY WITH ALGORITHM = AES_256
ENCRYPTION BY SERVER CERTIFICATE TDE_Cert;
ALTER DATABASE [YourDB] SET ENCRYPTION ON;
-- PostgreSQL: pgcrypto for column-level, full TDE in v17+ | Oracle: ALTER SYSTEM SET ENCRYPTION KEY
Best Practices
Back up certificates/keys immediately — loss means unrecoverable data
Store backups in separate secure location | Implement key rotation policy
Use customer-managed keys (BYOK) for regulatory compliance