postgres-advanced

The stated purpose is coherent for a PostgreSQL skill, and the OS/package-level prerequisites are normal. However, the skill’s real control plane is a custom `pg` CLI with no verified publisher relationship, package source, or release provenance, yet it receives the full database DSN and performs all privileged operations. That makes this skill suspicious with high security risk under the unverifiable-binary and credential-forwarding rules, though not confirmed malware from the provided text alone.