neon-functions
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for project management and deployment using the
neonCLI, including commands for environment synchronization (neon env pull), local development (neon dev), and full infrastructure deployment (neon deploy). It also references themcportertool for testing MCP servers. These commands are essential for interacting with the platform's serverless compute and database services. - [CREDENTIALS_UNSAFE]: The documentation explicitly warns against hardcoding secrets and provides clear instructions for using environment variables and git-ignored
.envfiles. It details how the Neon platform automatically injects sensitive connection strings (DATABASE_URL) and service tokens (AI Gateway, Object Storage) directly into the function runtime, reducing the risk of credential leakage. - [EXTERNAL_DOWNLOADS]: The skill describes installing standard developer dependencies from well-known registries (e.g., NPM packages like
hono,pg, anddrizzle-orm) and fetching official documentation. These operations are conducted through trusted tools and platforms associated with the vendor and the broader Node.js ecosystem. - [PRIVILEGE_ESCALATION]: In the context of deploying native binaries, the skill explains how to copy executables to a writable memory-backed directory (
/run) and apply execution permissions (chmod 755). This is a legitimate and documented requirement for running custom binaries within the Neon Functions serverless environment and is presented as a developer-managed configuration step.
Audit Metadata