cloud-sql-postgres-health
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses
npxto dynamically load and execute the@toolbox-sdk/serverpackage. This package is a versioned dependency fetched from the npm registry, which is a well-known service. The tool is part of the intended runtime environment for these extensions and is managed by the vendor.\n- [COMMAND_EXECUTION]: Subprocesses are spawned using the Node.jschild_process.spawnmethod to invoke diagnostic tools. The implementation includes logic to safely handle arguments on different operating systems, including escaping double quotes on Windows to mitigate potential command injection risks.\n- [CREDENTIALS_UNSAFE]: Database and cloud credentials are recovered from environment variables or local.envfiles. This follows standard security patterns for development tools and avoids hardcoding sensitive information within the source code.\n- [EXTERNAL_DOWNLOADS]: Dependencies are retrieved from the official npm registry at runtime using pinned versions to ensure consistency and security. This is an expected behavior for the tool's architecture.
Audit Metadata