neon-vercel-postgres
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill identifies and recommends the installation of official packages from well-known services, specifically
@neondatabase/serverlessand@vercel/postgres. These are standard dependencies for edge-compatible Postgres connections. - [COMMAND_EXECUTION]: The documentation includes instructions for using official CLI tools such as
neonctl(Neon CLI) anddrizzle-kit(Drizzle ORM migration tool). Additionally, the providedscripts/test-connection.tsscript executes standard database operations (CREATE, INSERT, SELECT, DROP) to verify connectivity. - [INDIRECT_PROMPT_INJECTION]: The skill manages a surface for indirect injection as it processes data from external database sources and environment variables.
- Ingestion points: Connection strings from
DATABASE_URLorPOSTGRES_URLand results from database queries. - Boundary markers: The skill explicitly instructs the agent and user to use tagged template literals (
sql`...`) to separate SQL commands from user-supplied data. - Capability inventory: The skill uses database network connections via HTTP/WebSockets and file system operations for schema generation via
drizzle-kit. - Sanitization: The skill mandates template tag syntax which provides automatic escaping and SQL injection protection.
Audit Metadata