conductor-neon-db
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script executes local development tools and CLI binaries including
neonctl,prisma,drizzle-kit, andtsx. These operations are fundamental to the skill's purpose of managing database branches and running migrations.\n- [SAFE]: The skill implements proactive security controls, including theassertDisposableChildBranchfunction which restricts destructive operations (delete and rename) to branches with specific prefixes (conductor/ortmp/). Branch names derived from workspace identifiers are sanitized to remove non-alphanumeric characters, preventing potential command injection vectors.\n- [SAFE]: The provisioning script mirrors theNEON_API_KEYinto a workspace-local.env.neondbfile. This is explicitly documented as a reliability fallback for Conductor'sarchivehook. The script applies restrictive file permissions (0o600) and provides instructions to ensure the file is excluded from version control via.gitignore.
Audit Metadata