# Oci Data Safe

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-adibirzu-oci-skills-oci-data-safe`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [adibirzu](https://agentstack.voostack.com/s/adibirzu)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [adibirzu](https://github.com/adibirzu)
- **Source:** https://github.com/adibirzu/oci-skills/tree/main/skills/oci-data-safe

## Install

```sh
agentstack add skill-adibirzu-oci-skills-oci-data-safe
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# OCI Data Safe

Register and assess databases with Data Safe safely. Reading assessments is safe;
**registration**, **audit-policy/retention changes**, and **masking** are
mutations and go through `run_action`. All CLI runs through
`oci_cli` (`../../scripts/common.sh`). Never inline real OCIDs, IPs, service
names, or credentials — use `` tokens.

## First move (always)

1. Confirm the tenancy/compartment:
   ```bash
   ./scripts/oci_preflight.sh -c 
   ```
2. Check the KB before debugging a registration failure:
   ```bash
   python3 scripts/kb_lookup.py "data safe target" observability-db
   ```

Read [../../references/data-safe.md](../../references/data-safe.md) for the
registration payloads, privilege scripts, and assessment/audit/masking commands,
and [../../references/tenancy-safety.md](../../references/tenancy-safety.md) for
the safety rules.

## Routing — pick the task

| Request mentions… | Go to |
|---|---|
| register/onboard a target, private endpoint | Target registration |
| privileges, "download privilege script", grants | DB-side privileges |
| security posture, risky config, drift | Security & User Assessment |
| audit events, retention, who did what | Activity Auditing |
| sensitive columns, PII discovery | Data Discovery |
| mask/redact data for non-prod | Data Masking |
| NEEDS_ATTENTION / ORA-01017 | Gotchas |

**Scope.** This skill drives the **OCI Data Safe service** (registration,
assessments, activity auditing, masking) — the security layer *around* the
database. For security work *inside* the database that Data Safe doesn't own —
SQL-level `GRANT`/`REVOKE`, Unified Auditing policy authoring, schema hardening —
route to `oracle/skills` `db/`. See
[references/oracle-skills-alignment.md](../../references/oracle-skills-alignment.md).

## Common multi-step flows

| Task | Sequence |
|------|----------|
| Register a target | ensure a Data Safe private endpoint (for cloud/Exadata DB) → run the DB-side privilege script → `target-database create` (creds via `file://`) → wait the work request → read the Security Assessment |
| Fix `NEEDS_ATTENTION` / `ORA-01017` | rotate the DB service-account password `CONTAINER=ALL` → update the target credential → wait the work request → re-check lifecycle-state (KB-057) |
| Mask a non-prod copy | run Data Discovery (sensitive data model) → **verify the target is a non-prod copy** → run masking (irreversible) → confirm masked columns |
| Audit a time window | `audit-event list --scim-query` with `auditEventTime` bounds (NOT `time_started`/`time_ended`, KB-032) → check retention covers the window |

## Common tasks

```bash
# Register an Autonomous DB target (credentials via file://, never argv).
run_action --risk additive --compartment  --description "register ADB target" -- oci_cli data-safe target-database create \
  --compartment-id  --display-name  \
  --database-details file://database-details.json \
  --credentials file://credentials.json

# Read latest Security Assessment for a target (safe).
oci_cli data-safe security-assessment list --compartment-id  \
  --target-id  --query 'data[0]'

# Activity audit window — scim_query, NOT time_started/time_ended.
oci_cli data-safe audit-event list --compartment-id  \
  --scim-query '(auditEventTime ge "") and (auditEventTime le "")'
```

## Key rules

- **Target type drives the payload:** `AUTONOMOUS_DATABASE` uses
  `autonomousDatabaseId`; `DATABASE_CLOUD_SERVICE` is keyed off
  `dbSystemId` + `serviceName` (not the DB OCID).
- **`target-database update` is async** (`--wait-for-state SUCCEEDED`) and needs
  `--force` non-interactively.
- **Audit queries use `scim_query`** for the time window.
- **`NEEDS_ATTENTION` + `ORA-01017`** = stale service-account password: rotate
  `CONTAINER=ALL`, update the target credential, wait the work request.

## Safety notes

- **Read assessments freely; gate the rest.** Registration, audit-policy/retention
  changes, and masking are mutations — `run_action`.
- **Never print or commit credentials.** `file://` payloads in `0600` files under a
  `0700` dir, deleted in `finally`; `redact` any output.
- **Mask only a verified non-prod copy** — it is irreversible on the masked data.
- **Never invent `oci` flags.** Fetch the exact command shape first:
  `python3 scripts/oci_cli_help.py  `.

## Expected output

```markdown
**Finding** — target/assessment state or risk (names, not OCIDs).
**Evidence** — redacted assessment / audit result.
**Action** — exact command(s); registration/masking gated by confirm/dry-run.
**Verification** — re-read the assessment / target lifecycle-state showing the result.
**KB** — KB entry used, or new KB- added.
```

## Official documentation

[Data Safe](https://docs.oracle.com/en-us/iaas/data-safe/doc/oracle-data-safe-overview.html). Full list in the [data-safe reference](../../references/data-safe.md).

**Open Knowledge Format grounding** — every doc link here is registered and liveness-checked in the [oracle-docs.md index](../../references/oracle-docs.md) (the pack's single source of truth). When extending this skill to build an OCI customer solution, cite the most specific official page through that index so every claim stays verifiable; the non-official MCP gateway is never a source of truth.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [adibirzu](https://github.com/adibirzu)
- **Source:** [adibirzu/oci-skills](https://github.com/adibirzu/oci-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-adibirzu-oci-skills-oci-data-safe
- Seller: https://agentstack.voostack.com/s/adibirzu
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.