Postgres Code Review

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:43 PM UTC
• Version: 1.1.1

Overview

This is a documentation-only PostgreSQL review skill with one insecure example to watch for, but it does not execute code or hide extra access.

Before relying on this skill's PgBouncer example, tighten it for your environment: bind only to localhost or a trusted interface, restrict the port, and prefer SCRAM/TLS where applicable. The rest of the artifact is review guidance, not code that runs automatically.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/connections.md:185

Finding

Insecure PgBouncer Example Exposes the Service on All Network Interfaces with Legacy Authentication

Content

View full analysis

Vulnerability Details

File Location: references/connections.md:185-192
Vulnerability Type: Insecure database proxy configuration
Risk Level: Medium

Vulnerable Code

ini

[databases]
mydb = host=localhost port=5432 dbname=mydb

[pgbouncer]
listen_addr = *
listen_port = 6432
auth_type = md5
auth_file = /etc/pgbouncer/userlist.txt

Technical Analysis

The document presents this PgBouncer configuration as a “GOOD” example, but listen_addr = * binds the service to every available network interface. This provides broader network exposure than is necessary for a typical local pooling example. The configuration also selects the legacy md5 authentication mechanism and does not require TLS or network-level access restrictions.

Because this is reference documentation rather than an active configuration file, it does not directly expose the system running the Skill. The security risk arises when a user copies the recommended configuration into a deployment. If port 6432 is reachable from an untrusted network, remote clients can interact with the authentication endpoint. Legacy authentication and absent transport-security guidance increase the risk of credential attacks or interception on an untrusted network.

The flagged HTTP requests elsewhere in references/connections.md target the reserved api.example.com example domain and do not send database results or credentials. They are illustrative, non-executing examples and are not a confirmed data-exfiltration vulnerability.

Attack Path

1. An operator copies the configuration identified as a good practice into a PgBouncer deployment.
2. PgBouncer binds port 6432 to all host interfaces through listen_addr = *.
3. A firewall, security group, or local network permits an untrusted party to reach that port.
4. The attacker connects to PgBouncer and performs account enumeration, password guessing, or credential-reuse attacks against the leg ...[truncated 1039 chars]

Remediation

View remediation

Remediation Suggestions

• Replace listen_addr = * with 127.0.0.1, ::1, or a specific trusted private interface unless wildcard binding is explicitly required.
• Use auth_type = scram-sha-256 with properly generated SCRAM credentials rather than legacy MD5 authentication.
• Require TLS for connections that cross host boundaries and validate certificates according to the deployment's trust model.
• Restrict port 6432 using host firewalls, security groups, and network allowlists so that only authorized application systems can connect.
• Run PgBouncer under a dedicated, unprivileged operating-system account.
• Grant application database roles only the minimum schema and operation privileges they require.
• Add authentication rate limiting or network-layer controls and monitor failed login attempts.
• Revise the documentation so the hardened configuration is the default example. If wildcard binding is retained for demonstration purposes, mark it as unsafe unless accompanied by explicit network restrictions.
• Include a deployment verification step confirming that port 6432 is not exposed to public or otherwise untrusted networks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/connections.md (reported line 222)May include surrounding context.

md

# Holding connection during external API call!
        async with httpx.AsyncClient() as client:
            response = await client.get(f"https://api.example.com/users/{user_id}")

        await conn.execute(
            "UPDATE users SET api_data = $1 WHERE id = $2",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/connections.md (reported line 236)May include surrounding context.

md

# Holding connection during external API call!
        async with httpx.AsyncClient() as client:
            response = await client.get(f"https://api.example.com/users/{user_id}")

        await conn.execute(
            "UPDATE users SET api_data = $1 WHERE id = $2",

Static analysis

No suspicious patterns detected.