pgvector

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:04 AM UTC
• Version: 1.0.0

Overview

This is a simple pgvector reference skill with no executable payload, but users should replace the documented blank local database password before real use.

Use this skill only against a PostgreSQL instance you control, and replace the example empty password with a real secret-managed credential before using it beyond a local throwaway environment. Review any generated CREATE, UPDATE, DELETE, or INSERT SQL before running it against valuable data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18

Finding

Database Access Configured with a Blank Password

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–34 and 164–170
Vulnerability Type: Insecure database authentication configuration
Risk Level: Medium

Vulnerable Code

bash

# Connect to pgvector database (default port 5433)
psql -h localhost -p 5433 -U damien -d postgres

# Or use environment variables
export PGHOST=localhost
export PGPORT=5433
export PGUSER=damien
export PGPASSWORD=''
export PGDATABASE=postgres

markdown

- **Host**: localhost
- **Port**: 5433
- **User**: damien
- **Password**: (empty)
- **Database**: postgres

python

conn = psycopg2.connect(
    host="localhost",
    port=5433,
    user="damien",
    password="",
    database="postgres"
)

Technical Analysis

The Skill consistently demonstrates PostgreSQL access through a fixed user account with an explicitly blank password. If the corresponding deployment permits passwordless access—for example, through a permissive pg_hba.conf rule, trust authentication, or equivalent local configuration—database authentication depends primarily on the caller's ability to reach the service.

The examples also normalize an insecure pattern that users may copy into production code or automation. Although the documented endpoint is limited to localhost, any untrusted process running on the same host may be able to attempt the connection. The actual exploitability and resulting privileges depend on PostgreSQL authentication rules and the permissions assigned to the damien role.

Attack Path

1. An attacker obtains the ability to run a process on the database host, such as through another local account, compromised service, or container with access to the host loopback service.
2. The attacker connects to localhost:5433, requests the damien role, and supplies no password.
3. If PostgreSQL is configured to accept passwordless authentication for that connection, the attacker re ...[truncated 869 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all blank-password examples and require a strong, non-empty database credential.
2. Retrieve credentials from a protected environment variable or secret manager rather than embedding them in documentation or source code.
3. Configure PostgreSQL to use SCRAM-SHA-256 authentication and remove permissive trust rules for application connections.
4. Create a dedicated application role instead of using a personal or broadly privileged account.
5. Grant only the required permissions on the specific database, schema, tables, and sequences; do not grant superuser, role-management, or unrestricted schema-creation privileges.
6. Restrict network access with PostgreSQL listen settings, host firewall rules, and narrowly scoped pg_hba.conf entries.
7. Update the Python example to fail when the credential is absent, for example by reading PGPASSWORD from the environment and validating that it is non-empty.
8. Rotate the database credential if the documented passwordless setup has already been deployed, and review database logs for unauthorized local connections.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is broadly scoped to generic activities like storing/retrieving embeddings, building AI applications, vector search, semantic search, and similarity matching. In agentic environments, such broad activation criteria can cause the skill to trigger in many unrelated database or AI tasks, increasing the chance of inappropriate tool use, unsafe query guidance, or accidental reliance on insecure defaults such as the documented empty database password.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.