claimable-postgres
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
get-dbutility andvite-plugin-dbpackage from the npm registry to facilitate database setup and project integration.- [REMOTE_CODE_EXECUTION]: Usesnpxto execute theget-dbtool directly from the remote npm package registry.- [COMMAND_EXECUTION]: Utilizescurlfor API interactions,npxfor database provisioning, andpsqlfor executing SQL seed scripts.- [DATA_EXFILTRATION]: Manages sensitive connection strings by writing them to.envfiles; includes proactive guidance to ensure these files are ignored by version control to prevent credential exposure.- [PROMPT_INJECTION]: The skill ingests untrusted data from the pg.new API response and user-supplied SQL seed files (Ingestion points). It lacks explicit boundary markers or delimiters for this data (Boundary markers). These inputs are used in operations likepsqlcommand execution and environment file writes (Capability inventory), with no specified sanitization or content validation (Sanitization).
Audit Metadata