ClawHub

ia-postgresql

Security checks across malware telemetry and agentic risk

Overview

This is a PostgreSQL reference skill with database examples, and it does not install code, run commands, request credentials, or hide unrelated behavior.

Install is reasonable for PostgreSQL help. Treat its SQL as examples: verify the target database, adapt locale-specific full-text search settings, review production impact with a database owner, and ensure backups or rollback plans before applying operational commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Low
Confidence
87% confidence
Finding
The examples repeatedly force PostgreSQL full-text search to use the 'english' configuration, which is a natural-language locale choice embedded in the skill content. Because the document does not mention that this is an example, a limitation, or an opt-in choice, it can conflict with language/locale policy expectations for multilingual users or datasets.

Hidden Instructions

High
Category
Prompt Injection
Content
Out of scope:
- Acting as the runtime instructions themselves (those live in `SKILL.md`).
- Trigger phrasings already covered by adjacent `ia-*` skills (`validate-plugin` flags >70% description overlap as DUPLICATE_TRIGGER).
- <!-- to fill in: domain-specific exclusions when the skill drifts -->

## Trigger Context
Confidence
70% confidence
Finding
<!-- to fill in: domain-specific exclusions when the skill drifts --> ## Trigger Context - Class: `language` - Hook regex: `plugins/whetstone/hooks/skill-patterns.sh` -> `SKILL_PATTERNS[ia-postgresq

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal