Postgres Query Optimizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent PostgreSQL tuning guide, but it under-warns users about running SQL that can change live databases and about sharing sensitive database telemetry.

Review before installing. Use this skill only with sanitized SQL and telemetry, prefer plain EXPLAIN for untrusted or state-changing statements, run runtime analysis on staging data when possible, and avoid sharing credentials, connection strings, personal data, tenant identifiers, or unrestricted pg_stat_statements exports.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:57
• Finding: Unqualified EXPLAIN ANALYZE Guidance Can Execute State-Changing SQL## Vulnerability Details **File Location**: `SKILL.md`, lines 57–62 **Vulnerability Type**: Unsafe execution guidance for arbitrary SQL **Risk Level**: High **Complete Code Snippet**: ```sql -- The agent recommends running: EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT) <your query>; -- For even more detail: EXPLAIN (ANALYZE, BUFFERS, VERBOSE, SETTINGS, WAL, FORMAT TEXT) <your query>; ``` ### Technical Analysis PostgreSQL's `EXPLAIN ANALYZE` does not merely inspect a statement. It executes the supplied SQL and collects runtime measurements. The skill accepts arbitrary slow SQL but recommends this command without restricting it to read-only statements, validating the statement type, requiring a non-production environment, or placing execution inside a rollback transaction. Consequently, using this guidance with `INSERT`, `UPDATE`, `DELETE`, `MERGE`, or SQL that invokes side-effecting functions can change database state. Even read-oriented statements can consume substantial resources or acquire locks when executed against large production datasets. ### Attack Path 1. An attacker or another untrusted source supplies a state-changing or resource-intensive SQL statement as a query-optimization request. 2. The skill recommends wrapping the supplied statement in `EXPLAIN (ANALYZE, BUFFERS)`. 3. A user executes the generated command against a live PostgreSQL database. 4. PostgreSQL executes the underlying statement. 5. The statement modifies data, invokes triggers or side-effecting functions, acquires disruptive locks, or exhausts database resources. ### Impact Assessment The operation runs with the privileges of the database role used by the user. It does not independently elevate privileges, but it may exercise every data-access and mutation privilege already granted to that role. Potential scope includes unauthorized or unintended insertion, modification, or deletion of accessible records; trigger execution; lock contention; excessive CPU, memory, an ...[truncated 138 chars]
• Remediation: ## Remediation Suggestions 1. Inspect and classify the SQL statement before recommending `EXPLAIN ANALYZE`. 2. For untrusted or state-changing SQL, recommend plain `EXPLAIN` first because it does not execute the statement. 3. Require runtime analysis of mutation statements to occur on an isolated staging database populated with non-sensitive test data. 4. Where transaction rollback is appropriate, provide guarded instructions such as: ```sql BEGIN; SET LOCAL statement_timeout = '30s'; EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT) <statement>; ROLLBACK; ``` 5. Explicitly warn that rollback does not neutralize every possible side effect, including sequence changes, external calls made by functions, autonomous external effects, and resource consumption. 6. Recommend a least-privileged database role, a restrictive `statement_timeout`, and appropriate lock and resource limits. 7. Require explicit confirmation before analyzing any non-`SELECT` statement on a live database.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:350
• Finding: Workload Export Guidance Omits Sensitive Query-Data Redaction## Vulnerability Details **File Location**: `SKILL.md`, line 350 **Vulnerability Type**: Potential sensitive information exposure through database telemetry **Risk Level**: Medium **Complete Code Snippet**: ```markdown - For ongoing optimization, export `pg_stat_statements` output for workload-level analysis ``` ### Technical Analysis The guidance encourages users to export `pg_stat_statements` output without specifying which fields are necessary or requiring inspection and redaction before the export is shared. This telemetry can expose normalized query text, database and role identifiers, workload structure, table and column names, query comments, and operational metrics. Depending on PostgreSQL behavior and how applications construct SQL, query material may also reveal literals or other sensitive context. Sharing an unrestricted export with an AI agent or another external analysis system may therefore disclose information beyond what is necessary for performance analysis. ### Attack Path 1. The skill requests or encourages a workload-level `pg_stat_statements` export. 2. A user exports unrestricted rows and columns from the view. 3. The export contains sensitive SQL text, identifiers, comments, workload metadata, or data embedded in SQL. 4. The user submits the export to an AI conversation or another analysis environment. 5. Sensitive database information becomes accessible to that environment and may be retained in its logs or processing systems. ### Impact Assessment This issue does not provide database privileges or direct code execution. Its impact is information disclosure within the scope of the exported telemetry. Potentially exposed information includes database structure, application behavior, tenant or account identifiers, role names, sensitive query fragments, operational volumes, and performance characteristics. Such information may support subsequent reconnaissance or expose confidential application and business details.
• Remediation: ## Remediation Suggestions 1. Request only the telemetry fields needed for analysis, such as a sanitized query identifier and aggregate timing, call-count, row-count, and buffer metrics. 2. Instruct users to inspect and redact query text, comments, literals, database names, role names, schema names, table names, tenant identifiers, personal data, credentials, tokens, and other confidential values before sharing. 3. Prefer sanitized, `queryid`-based aggregates when full SQL text is unnecessary. 4. Recommend performing sanitization inside the trusted database environment before creating the export. 5. Add an explicit prohibition against sharing credentials, connection strings, authentication tokens, or personal data. 6. Advise users to follow organizational data-handling and retention policies before transmitting database telemetry to an external service.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The manifest description says the skill triggers on phrases such as "query optimization", "query plan", and especially "database performance", which are broad and could match many general database-help requests beyond PostgreSQL slow-query analysis. The trigger list does not include exclusion conditions or tighter scope constraints, increasing the chance of unintended invocation.

Static analysis

No suspicious patterns detected.