cloud-sql-postgres-health

Pass

Audited by Gen Agent Trust Hub on Apr 28, 2026

Risk Level: SAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill uses npx to dynamically load and execute the @toolbox-sdk/server package. This package is a versioned dependency fetched from the npm registry, which is a well-known service. The tool is part of the intended runtime environment for these extensions and is managed by the vendor.\n- [COMMAND_EXECUTION]: Subprocesses are spawned using the Node.js child_process.spawn method to invoke diagnostic tools. The implementation includes logic to safely handle arguments on different operating systems, including escaping double quotes on Windows to mitigate potential command injection risks.\n- [CREDENTIALS_UNSAFE]: Database and cloud credentials are recovered from environment variables or local .env files. This follows standard security patterns for development tools and avoids hardcoding sensitive information within the source code.\n- [EXTERNAL_DOWNLOADS]: Dependencies are retrieved from the official npm registry at runtime using pinned versions to ensure consistency and security. This is an expected behavior for the tool's architecture.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 28, 2026, 10:24 PM