Security audit

claimable-postgres

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it asks agents to run mutable remote packages and load another mutable skill while also creating a database and writing credentials locally.

Review before installing. Prefer the documented curl REST API path, ask the agent to confirm before creating a database or writing any .env file, avoid --yes where possible, and do not run neon-new@latest or deno run -A unless you trust the current package and accept the local code-execution risk.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:42
Finding: Unpinned Remote Package Execution
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:15
Finding: Mutable External Skill Retrieval Without Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (17)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

Gather options: Use defaults unless context suggests otherwise (e.g., user mentions a custom env file, seed SQL, or logical replication).

Run: Execute with @latest --yes plus the confirmed options. Always use @latest to avoid stale cached versions. --yes skips interactive prompts that would stall the agent.
bash
npx neon-new@latest --yes --ref agent-skills --env .env.local --seed ./schema.sql

Verify: Confirm the connection string was written to the intended file.

Report: Cover every item in the Output Checklist.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
- Ask before running destructive seed SQL (`DROP`, `TRUNCATE`, mass `DELETE`). - For production workloads, recommend standard Neon provisioning instead of temporary claimable databases. - If users need long-term persistence, instruct them to open the claim URL right away. - After writing credentials to an .env file, check that it's covered by .gitignore. If not, warn the user. Do not modify `.gitignore` without confirmation. ## REST API

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.
md
- Ask before running destructive seed SQL (`DROP`, `TRUNCATE`, mass `DELETE`). - For production workloads, recommend standard Neon provisioning instead of temporary claimable databases. - If users need long-term persistence, instruct them to open the claim URL right away. - After writing credentials to an .env file, check that it's covered by .gitignore. If not, warn the user. Do not modify `.gitignore` without confirmation. ## REST API

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: MCP server references in the skill manifest without version pinning are a rug-pull risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
FIRST: Use the parent neon skill for a Neon overview, getting started with Neon, Neon development best practices, and more.

If the neon skill is not installed, fetch it from https://neon.com/docs/ai/skills/neon/SKILL.md or install it with:

bash
npx skills add neondatabase/agent-skills --skill neon

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs installing a parent skill via 'npx skills add ...' without pinning a specific version. Using an unpinned npx package can expose users to supply-chain risk if a new or compromised package version is published and automatically executed.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The skill directs the agent to make an external POST request to provision a database, which transmits data to a third-party service and creates external resources. Even though the payload is minimal, any autonomous network action should be clearly disclosed and ideally confirmed by the user before execution.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
Quick Start

bash
curl -s -X POST "https://neon.new/api/v1/database" \ -H "Content-Type: application/json" \ -d '{"ref": "agent-skills"}'

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The workflow authorizes provisioning a remote database and writing returned credentials into '.env' with only intent confirmation when the request is unambiguous. That permits autonomous external actions and local secret modification without explicit operational consent, which can violate least surprise and create security or cost exposure.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Confirm intent: If the request is ambiguous, confirm the user wants a temporary, no-signup database. Skip this if they explicitly asked for a quick or temporary database.

Provision: POST to https://neon.new/api/v1/database with {"ref": "agent-skills"}.

Parse response: Extract connection_string, claim_url, and expires_at from the JSON response.

Write .env: Write DATABASE_URL=<connection_string> to the project's .env (or the user's preferred file and key). Do not overwrite an existing key without confirmation.

Seed (if needed): If the user has a seed SQL file, run it against the new database:
bash
psql "$DATABASE_URL" -f seed.sql

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 82% confidence
Finding: This section shows some good safeguards, but it still implies the skill may proceed with writing credentials first and only later check repository hygiene. The dangerous aspect is not the note itself, but the broader workflow allowing sensitive file writes absent explicit consent and pre-checks.
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
- Ask before running destructive seed SQL (`DROP`, `TRUNCATE`, mass `DELETE`). - For production workloads, recommend standard Neon provisioning instead of temporary claimable databases. - If users need long-term persistence, instruct them to open the claim URL right away. - After writing credentials to an .env file, check that it's covered by .gitignore. If not, warn the user. Do not modify `.gitignore` without confirmation. ## REST API

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
-d '{"ref": "agent-skills"}'

text
| Parameter | Required | Description | | ---------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------- | | `ref` | Yes | Tracking tag that identifies who provisioned the database. Use `"agent-skills"` when provisioning through this skill. | | `enable_logical_replication` | No | Enable logical replication (default: false, cannot be disabled once enabled) |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The guidance explicitly recommends '--yes' to suppress prompts so the agent can run non-interactively. In the context of provisioning infrastructure and writing secrets, suppressing prompts increases the risk of unauthorized or unexpected actions.
Content: Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.
md
| Option | Alias | Description | Default | | ----------------------- | ----- | --------------------------------------------------------------------- | -------------- | | `--yes` | `-y` | Skip prompts, use defaults | `false` | | `--env` | `-e` | .env file path | `./.env` | | `--key` | `-k` | Connection string env var key | `DATABASE_URL` | | `--prefix` | `-p` | Prefix for generated public env vars | `PUBLIC_` |

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill tells the agent to write a database connection string into '.env' without an explicit upfront warning that local files will be modified and that secrets will be stored on disk. This can surprise users and increase the chance of accidental credential exposure, especially in repos not properly ignored by version control.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T03 · Remote Payload Retrieval and Execution

SkillSpector

Credential Access

Credential Access

Credential Access

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Skill Enumeration

Rp1

External Transmission

Quick Start

Autonomous Decision Making

Autonomous Decision Making

Whitespace Padding

Autonomous Decision Making

Missing User Warnings

Static analysis