Skills
Navigate
skills/impertio-studio/postgresql-claude-skill-package/postgres-impl-bulk-loading/Gen Agent Trust Hub

postgres-impl-bulk-loading

Warn

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides documentation and examples for the COPY ... PROGRAM feature, which enables the database server process to execute arbitrary shell commands on the host operating system.\n
  • Evidence: Found in references/methods.md (grammar definition) and references/examples.md (e.g., COPY country TO PROGRAM 'gzip > ...').\n- [REMOTE_CODE_EXECUTION]: By instructing users on the COPY ... PROGRAM pattern, the skill facilitates a mechanism for code execution on the database server. While this is a native PostgreSQL capability, it poses a significant risk if the commands executed or the files accessed are influenced by untrusted inputs.\n- [CREDENTIALS_UNSAFE]: The skill includes hardcoded placeholder credentials in its examples for cross-database connectivity.\n
  • Evidence: SKILL.md (Pattern 7) and references/examples.md (Pattern 14) contain CREATE USER MAPPING SQL statements with password 'secret'.\n- [DATA_EXFILTRATION]: The skill provides patterns for using the postgres_fdw extension to connect the local database to remote servers, which creates a potential path for data transfer out of the local environment.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 17, 2026, 01:10 AM
Security Audit — agent-trust-hub — postgres-impl-bulk-loading