The Agent Skills Directory

[COMMAND_EXECUTION]: The documentation provides instructions for using psql features that interact with the host system, such as \! for executing shell commands and \copy ... program for piping data to or from shell commands. These capabilities are presented as standard tool features and are accompanied by explicit warnings about command injection risks and advice to avoid concatenating untrusted input.
[EXTERNAL_DOWNLOADS]: The skill provides installation commands for the PostgreSQL client tools using well-known system package managers including Homebrew (brew), APT, YUM, and APK. These references target trusted official package repositories for standard operating systems.
[INDIRECT_PROMPT_INJECTION]: The skill documents how psql processes external input from files and prompts. It identifies the risk of SQL injection during variable interpolation and provides detailed guidance on mitigation techniques, such as using the \bind command for truly parameterized queries and using quoted variable syntax (:'varname') to ensure proper escaping.
[CREDENTIALS_UNSAFE]: The documentation mentions authentication methods, including environment variables and connection URIs. It correctly identifies the security risks associated with these methods (such as visibility in process listings) and strongly recommends the use of a secure .pgpass file with restricted permissions (chmod 600), which is an industry best practice for secret management.

postgresql-cli