Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Neon setup guide, with disclosed steps that can install Neon tooling and write Neon credentials or environment variables locally.
Install only if you want an agent to manage Neon resources. Review before global installs or skill updates, prefer OAuth or project-scoped MCP setup when possible, and use --no-env-pull or runtime env injection if you do not want DATABASE_URL or API credentials written into local files.
Referenced artifact was not completely inspected
ed and accessible (for example, it appears in the available skills list or its `SKILL.md` is present). If it is, use it directly. If it is not installed, instal
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Claim
Do not mint a claim URL until the human is ready. Opening the URL does not freeze access. Continuing to Neon starts the transfer and rotates `DATABASE_URL`. Existing access tokens are revoked. Auth and the Data API stay enabled when they were granted.
A claim code expires in `expires_in` seconds (15 minutes / 900 today). If the unused code expires, mint another: `neon claim accept --no-open` or `POST /v1/projects/{id}/claim`. Each mint cancels the previous unused code. You can mint several times; only the latest unused code works. Re-issue only while `project_expires_at` is still in the future.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Claim
Do not mint a claim URL until the human is ready. Opening the URL does not freeze access. Continuing to Neon starts the transfer and rotates `DATABASE_URL`. Existing access tokens are revoked. Auth and the Data API stay enabled when they were granted.
A claim code expires in `expires_in` seconds (15 minutes / 900 today). If the unused code expires, mint another: `neon claim accept --no-open` or `POST /v1/projects/{id}/claim`. Each mint cancels the previous unused code. You can mint several times; only the latest unused code works. Re-issue only while `project_expires_at` is still in the future.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
| `neon claim create` | `POST /v1/agent/identity`, then `POST /v1/oauth2/token`, then `GET /v1/projects/{id}/credentials` |
| `neon claim accept --no-open` | `POST /v1/projects/{id}/claim` |
| `neon claim status` | `GET /v1/projects/{id}/claim` |
| `neon claim delete --yes` | `DELETE /v1/projects/{id}` |
The skill advertises extremely broad trigger conditions such as generic references to postgres, database, backend, logs, or LLM calls, which can cause it to activate for many unrelated requests. Over-broad activation increases the chance that an agent loads and follows this skill in contexts where its provisioning, CLI, and infrastructure guidance is inappropriate, potentially steering the agent into unnecessary credentialed operations or configuration changes.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
The skills below live in the [`neondatabase/agent-skills`](https://github.com/neondatabase/agent-skills) repo:
| Skill | Use it for |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `neon-postgres` | Working with databases, including connections, schemas, queries, search, and autoscaling: SQL development, schema design, performance optimization, and scaling decisions. |
| `neon-auth` | Identity routing and Managed Better Auth setup (login, users, sessions, trusted domains). Fetch: https://neon.com/docs/ai/skills/neon-auth/SKILL.md |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `neon-postgres` | Working with databases, including connections, schemas, queries, search, and autoscaling: SQL development, schema design, performance optimization, and scaling decisions. |
| `neon-auth` | Identity routing and Managed Better Auth setup (login, users, sessions, trusted domains). Fetch: https://neon.com/docs/ai/skills/neon-auth/SKILL.md |
| `neon-postgres-branches` | Choosing or creating the right branch type for dev, preview, test, or CI workflows. Use this skill as a slash command. |
| `neon-object-storage` | Storing and serving files (uploads, images, blobs), including branching them with the database. |
| `neon-functions` | Deploying long-running or streaming serverless functions — APIs, agents, SSE/WebSocket servers, and Function Triggers (cron and object-storage). |
| `neon-ai-gateway` | Calling an LLM or routing across model providers with one credential, including discovering the branch's servable models at runtime via the OpenAI-compatible `/v1/models` endpoint. |
| `neon-postgres-egress-optimizer` | Diagnosing or fixing excessive Postgres egress (network data-transfer) costs in a codebase. |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `neon-object-storage` | Storing and serving files (uploads, images, blobs), including branching them with the database. |
| `neon-functions` | Deploying long-running or streaming serverless functions — APIs, agents, SSE/WebSocket servers, and Function Triggers (cron and object-storage). |
| `neon-ai-gateway` | Calling an LLM or routing across model providers with one credential, including discovering the branch's servable models at runtime via the OpenAI-compatible `/v1/models` endpoint. |
| `neon-postgres-egress-optimizer` | Diagnosing or fixing excessive Postgres egress (network data-transfer) costs in a codebase. |
There is no `neon-data-api` skill. Configure `dataApi` in `neon.ts` only for PostgREST / Supabase database-client compatibility or a migration that already depends on it.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Replace `<skill-name>` with the skill you need (for example, `neon-object-storage`, `neon-functions`, or `neon-ai-gateway`). Useful flags:
- `--global` — install globally instead of into the current project.
- `-y` — non-interactive mode (skip prompts).
- `--agent <agent-name>` — pick the target agent(s) for non-interactive mode.
For example, to install the object storage skill globally for a specific agent without prompts:
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Replace `<skill-name>` with the skill you need (for example, `neon-object-storage`, `neon-functions`, or `neon-ai-gateway`). Useful flags:
- `--global` — install globally instead of into the current project.
- `-y` — non-interactive mode (skip prompts).
- `--agent <agent-name>` — pick the target agent(s) for non-interactive mode.
For example, to install the object storage skill globally for a specific agent without prompts:
This instruction tells the agent to fetch an uninstalled skill from a remote URL and even fall back to GitHub if unpublished, which creates a dynamic remote-instruction loading path. In a skill-execution environment, pulling and trusting additional prompt content at runtime increases prompt-injection and supply-chain risk because the newly fetched skill may alter agent behavior without local review.
neon-auth is not in the CLI skill catalog of current releases. Unknown names fail, so do not run neon skills -s neon-auth. Fetch it:
https://neon.com/docs/ai/skills/neon-auth/SKILL.md
References: https://neon.com/docs/ai/skills/neon-auth/references/managed-auth.md and https://neon.com/docs/ai/skills/neon-auth/references/self-managed.md. If those URLs are unpublished, fetch the same files from https://github.com/neondatabase/agent-skills/blob/main/skills/neon-auth/SKILL.md
The fallback to manually visit a registry and fetch skills broadens the set of remote instructions an agent may ingest. Even when the domain is legitimate, runtime skill discovery and retrieval materially increases attack surface and makes behavior dependent on mutable external content.
https://neon.com/docs/ai/skills/neon-auth/SKILL.md
References: https://neon.com/docs/ai/skills/neon-auth/references/managed-auth.md and https://neon.com/docs/ai/skills/neon-auth/references/self-managed.md. If those URLs are unpublished, fetch the same files from https://github.com/neondatabase/agent-skills/blob/main/skills/neon-auth/SKILL.md
If the Neon CLI is not available, you can visit https://neon.com/.well-known/agent-skills for a registry of all available Neon skills and fetch them manually.
The skill recommends commands that automatically pull environment variables into local files, but the nearby guidance does not clearly foreground that this writes secrets such as DATABASE_URL and gateway credentials onto disk. In an agent setting, silent local secret writes can leak credentials into developer workspaces, shell history, backups, or accidental commits if repository hygiene is imperfect.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### How checkout composes with neon.ts
When a `neon.ts` is present, `neon checkout <name> --create` applies your policy as it **creates** a branch, so a fresh branch comes up with its declared settings and services already in place. Pass `--env <file>` on that create so Function env that reads `process.env` resolves (`neon checkout feat --create --env .env.local`). Existing process env wins over the file. Checking out an _existing_ branch never reconciles it — apply config changes to it explicitly with `neon deploy --env <file>` (alias for `neon config apply`). `--update-existing` auto-confirms overriding remote settings; add it only after reviewing those changes. The bundled `env pull` also checks `neon.ts` against the linked branch and fails fast if the branch is missing a declared service, pointing you at `neon deploy --env <file>` to provision it, so your local env and the remote branch never drift apart silently.
### Opting out of local env vars
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Login identity lives in the `neon-auth` skill: choose Managed Better Auth, keep existing Better Auth or another IdP, or point at self-managed Better Auth when a required feature is outside Managed support.
Fetch https://neon.com/docs/ai/skills/neon-auth/SKILL.md
Until the released CLI catalog includes `neon-auth`, do not run `neon skills -s neon-auth` (unknown names fail). If the neon.com URL is unpublished, fetch https://github.com/neondatabase/agent-skills/blob/main/skills/neon-auth/SKILL.md
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Login identity lives in the `neon-auth` skill: choose Managed Better Auth, keep existing Better Auth or another IdP, or point at self-managed Better Auth when a required feature is outside Managed support.
Fetch https://neon.com/docs/ai/skills/neon-auth/SKILL.md
Until the released CLI catalog includes `neon-auth`, do not run `neon skills -s neon-auth` (unknown names fail). If the neon.com URL is unpublished, fetch https://github.com/neondatabase/agent-skills/blob/main/skills/neon-auth/SKILL.md
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Login identity lives in the `neon-auth` skill: choose Managed Better Auth, keep existing Better Auth or another IdP, or point at self-managed Better Auth when a required feature is outside Managed support.
Fetch https://neon.com/docs/ai/skills/neon-auth/SKILL.md
Until the released CLI catalog includes `neon-auth`, do not run `neon skills -s neon-auth` (unknown names fail). If the neon.com URL is unpublished, fetch https://github.com/neondatabase/agent-skills/blob/main/skills/neon-auth/SKILL.md
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
DELETE https://claimable.neon.tech/v1/projects/{id}
| CLI | REST |
| ----------------------------- | ------------------------------------------------------------------------------------------------- |
| `neon claim create` | `POST /v1/agent/identity`, then `POST /v1/oauth2/token`, then `GET /v1/projects/{id}/credentials` |
| `neon claim accept --no-open` | `POST /v1/projects/{id}/claim` |
This markdown file includes direct HTTP usage with Authorization: Bearer <NEON_API_KEY>, which involves sensitive credentials. The surrounding text explains how to authenticate but does not include any warning about protecting the API key or avoiding exposure in logs, shell history, or shared examples.
No suspicious patterns detected.