postgresql-cli
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill acts as an educational and reference resource for the psql tool, describing its object inspection, formatting, and data import/export capabilities without including malicious instructions.
- [COMMAND_EXECUTION]: Documents psql's shell-interaction features, such as the shell escape command (\!), piping output to shell commands (\g | command), and executing programs via \copy, while providing clear security caveats regarding command injection risks.
- [CREDENTIALS_UNSAFE]: Provides connection guidance that explicitly warns against insecure practices like hardcoding passwords in connection strings or using the PGPASSWORD environment variable, recommending the secure ~/.pgpass method instead.
- [PROMPT_INJECTION]: Discusses the risks of SQL injection during variable interpolation and instructs the agent to use safer alternatives such as single-quoted string substitution (:'varname') or truly parameterized queries using \bind.
Audit Metadata