postgresql-cli

Warn

Audited by Socket on Jul 31, 2026

1 alert found:

Security
SecurityMEDIUM
references/tips-workflows.md

No direct malicious payloads (e.g., credential theft, network exfiltration, reverse shells) are evidenced in the provided fragment because it appears to be documentation/examples. However, it clearly demonstrates multiple high-impact execution primitives—\\gexec for runtime SQL execution and backquote expansion for host shell command execution—along with filesystem/script inclusion and COPY program piping. These capabilities are dangerous in automation contexts if any inputs or included content can be influenced or tampered with; this warrants strict input validation, least-privilege execution, and restricting or eliminating \\gexec/backquotes/\\copy-program/include patterns in untrusted pipelines.

Confidence: 58%Severity: 72%
Audit Metadata
Analyzed At
Jul 31, 2026, 04:37 PM
Package URL
pkg:socket/skills-sh/sickn33%2Fagentic-awesome-skills%2Fpostgresql-cli%2F@5a83ab11ebd1440d0a480e4248ca9f2ceee103e07b1a41b5124b745f5712bd2e
Security Audit — socket — postgresql-cli