neon-postgres

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md instructs fetching Neon documentation over the public web at runtime (e.g., curl https://neon.com/llms.txt and curl -H "Accept: text/markdown" https://neon.com/docs/...), which is outsider-authored free text ingested into the agent’s context after download/markdown conversion.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the assistant to fetch Neon documentation at runtime (e.g., curl https://neon.com/llms.txt and curl -H "Accept: text/markdown" https://neon.com/docs/ in SKILL.md) and to use those remote docs as the "source of truth" for responses, so remote content will directly control the agent's prompts/outputs.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged literal, high-entropy tokens found in the documentation examples:
• The example API key (napi_... ) is a long, random-looking bearer token — matches the definition of an API secret.
• Multiple example connection URIs include random-looking DB passwords (values prefixed with "npg_...") present as literal strings in JSON/URI fields — these are high-entropy credentials.

I ignored obvious placeholders and environment-variable names such as $NEON_API_KEY, "your-api-key", and simple example passwords like "password" that appear elsewhere in the docs because they are placeholders or low-entropy examples and are explicitly exempted by the scanning rules.