neon-functions

Pass

Audited by Gen Agent Trust Hub on Nov 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for project management and deployment using the neon CLI, including commands for environment synchronization (neon env pull), local development (neon dev), and full infrastructure deployment (neon deploy). It also references the mcporter tool for testing MCP servers. These commands are essential for interacting with the platform's serverless compute and database services.
  • [CREDENTIALS_UNSAFE]: The documentation explicitly warns against hardcoding secrets and provides clear instructions for using environment variables and git-ignored .env files. It details how the Neon platform automatically injects sensitive connection strings (DATABASE_URL) and service tokens (AI Gateway, Object Storage) directly into the function runtime, reducing the risk of credential leakage.
  • [EXTERNAL_DOWNLOADS]: The skill describes installing standard developer dependencies from well-known registries (e.g., NPM packages like hono, pg, and drizzle-orm) and fetching official documentation. These operations are conducted through trusted tools and platforms associated with the vendor and the broader Node.js ecosystem.
  • [PRIVILEGE_ESCALATION]: In the context of deploying native binaries, the skill explains how to copy executables to a writable memory-backed directory (/run) and apply execution permissions (chmod 755). This is a legitimate and documented requirement for running custom binaries within the Neon Functions serverless environment and is presented as a developer-managed configuration step.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 7, 2026, 09:14 PM