pgpm
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill describes a legitimate developer tool for managing PostgreSQL database migrations. The instructions provide guidance on project scaffolding, deployment lifecycles, and testing patterns.
- [EXTERNAL_DOWNLOADS]: The skill references standard package management operations via
npm installand its ownpgpm installcommand to fetch database modules from npm. These operations target expected registries and vendor-controlled repositories. - [COMMAND_EXECUTION]: The skill uses standard CLI commands for managing local development environments, including
pgpm dockerfor container lifecycle management andeval "$(pgpm env)"for loading environment variables into the shell session. These are routine operations for database-centric development tools. - [CREDENTIALS_SAFE]: While the skill discusses environment variables for database authentication (e.g.,
PGPASSWORD), the examples use placeholders likepasswordorminioadminfor local development. There are no patterns suggesting the exfiltration of sensitive credentials to unauthorized external services.
Audit Metadata