claimable-postgres

Pass

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the get-db utility and vite-plugin-db package from the npm registry to facilitate database setup and project integration.- [REMOTE_CODE_EXECUTION]: Uses npx to execute the get-db tool directly from the remote npm package registry.- [COMMAND_EXECUTION]: Utilizes curl for API interactions, npx for database provisioning, and psql for executing SQL seed scripts.- [DATA_EXFILTRATION]: Manages sensitive connection strings by writing them to .env files; includes proactive guidance to ensure these files are ignored by version control to prevent credential exposure.- [PROMPT_INJECTION]: The skill ingests untrusted data from the pg.new API response and user-supplied SQL seed files (Ingestion points). It lacks explicit boundary markers or delimiters for this data (Boundary markers). These inputs are used in operations like psql command execution and environment file writes (Capability inventory), with no specified sanitization or content validation (Sanitization).
Audit Metadata
Risk Level
SAFE
Analyzed
May 12, 2026, 01:08 PM