pgpm

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill describes a legitimate developer tool for managing PostgreSQL database migrations. The instructions provide guidance on project scaffolding, deployment lifecycles, and testing patterns.
  • [EXTERNAL_DOWNLOADS]: The skill references standard package management operations via npm install and its own pgpm install command to fetch database modules from npm. These operations target expected registries and vendor-controlled repositories.
  • [COMMAND_EXECUTION]: The skill uses standard CLI commands for managing local development environments, including pgpm docker for container lifecycle management and eval "$(pgpm env)" for loading environment variables into the shell session. These are routine operations for database-centric development tools.
  • [CREDENTIALS_SAFE]: While the skill discusses environment variables for database authentication (e.g., PGPASSWORD), the examples use placeholders like password or minioadmin for local development. There are no patterns suggesting the exfiltration of sensitive credentials to unauthorized external services.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 02:27 AM
Security Audit — agent-trust-hub — pgpm