conductor-neon-db

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script executes local development tools and CLI binaries including neonctl, prisma, drizzle-kit, and tsx. These operations are fundamental to the skill's purpose of managing database branches and running migrations.\n- [SAFE]: The skill implements proactive security controls, including the assertDisposableChildBranch function which restricts destructive operations (delete and rename) to branches with specific prefixes (conductor/ or tmp/). Branch names derived from workspace identifiers are sanitized to remove non-alphanumeric characters, preventing potential command injection vectors.\n- [SAFE]: The provisioning script mirrors the NEON_API_KEY into a workspace-local .env.neondb file. This is explicitly documented as a reliability fallback for Conductor's archive hook. The script applies restrictive file permissions (0o600) and provides instructions to ensure the file is excluded from version control via .gitignore.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 10:31 PM