Security audit
Security checks for vulnerabilities and agentic risk
This PostgreSQL skill is mostly coherent, but it can perform high-impact database changes and destructive restores without clear safeguards or confirmation guidance.
Install only if you are comfortable giving an agent PostgreSQL credentials and authority to run database operations. Use least-privileged database accounts, avoid production targets unless explicitly intended, review every mutating SQL or restore command before execution, and treat backups/schema exports as sensitive files.
The Chinese description likewise overstates the skill as a general-purpose PostgreSQL operations tool while the detected implementation appears much narrower and centered on schema metadata export. In multilingual manifests, inconsistent or inflated descriptions can cause users and orchestration logic to invoke the skill for actions it is not designed or reviewed to perform.
The Chinese description likewise overstates the skill as a general-purpose PostgreSQL operations tool while the detected implementation appears much narrower and centered on schema metadata export. In multilingual manifests, inconsistent or inflated descriptions can cause users and orchestration logic to invoke the skill for actions it is not designed or reviewed to perform.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def get_env(dbname=None):
"""Get environment for pg_dump"""
env = os.environ.copy()
env['PGHOST'] = os.environ.get('PGHOST', 'localhost')
env['PGPORT'] = os.environ.get('PGPORT', '5432')
env['PGDATABASE'] = dbname or os.environ.get('PGDATABASE', 'postgres')
The skill advertises database querying, backup, and schema export capabilities but does not declare any tool scope or permissions despite requiring shell, filesystem, and environment-variable access. In an agent setting, this creates an overbroad and opaque execution surface where sensitive credentials, local files, and shell commands may be accessed without explicit review or restriction.
The trigger phrases are broad and open-ended, covering general mentions of PostgreSQL, SQL queries, schema, and backups without boundaries or exclusions. In an agent environment, this can cause the skill to activate in contexts involving sensitive production databases or destructive requests, even when a narrower, safer tool would be more appropriate.
The skill description includes INSERT/UPDATE/DELETE and backup/restore capabilities but provides no warning about data loss, modification risk, or the need for explicit confirmation before destructive actions. In the database context, this materially increases the chance of accidental writes, restores, or recovery steps impacting live systems.
The document includes destructive database commands like DROP DATABASE without any caution, confirmation guidance, or backup prerequisites. In a database operations skill, users may copy commands directly, and omission of safety context materially increases the risk of accidental irreversible data loss or service disruption.
Showing DROP TABLE without warning can lead users to remove entire tables irreversibly, including schema and data. Because this skill is meant for operational PostgreSQL usage, the command is especially likely to be executed verbatim in real environments.
DELETE FROM examples are presented without emphasizing the importance of restrictive WHERE clauses, transaction use, or rollback planning. This can easily cause mass deletion of production data if a user omits or mis-specifies the condition.
The pg_restore command uses the cleanup option (-c), which can drop existing database objects before restore, yet no warning explains overwrite or destruction risk. In an admin-focused skill, this omission can lead to accidental replacement or loss of live database contents.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
env = get_env(dbname)
try:
result = subprocess.run(cmd, env=env, capture_output=True, text=True)
if result.returncode == 0:
size = os.path.getsize(backup_path)
print(f"Backup created: {backup_path} ({size:,} bytes)")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
env = get_env(dbname)
try:
result = subprocess.run(cmd, env=env, capture_output=True, text=True)
if result.returncode == 0:
size = os.path.getsize(backup_path)
print(f"Backup created: {backup_path} ({size:,} bytes)")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
env = get_env(dbname)
try:
result = subprocess.run(cmd, env=env, capture_output=True, text=True)
if result.returncode == 0:
size = os.path.getsize(backup_path)
print(f"Backup created: {backup_path} ({size:,} bytes)")
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
env = get_env(dbname)
try:
result = subprocess.run(cmd, env=env, capture_output=True, text=True)
if result.returncode == 0:
size = os.path.getsize(backup_path)
print(f"Backup created: {backup_path} ({size:,} bytes)")
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
env = get_env(dbname)
try:
result = subprocess.run(cmd, env=env, capture_output=True, text=True)
if result.returncode == 0:
size = os.path.getsize(backup_path)
print(f"Backup created: {backup_path} ({size:,} bytes)")
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
env = get_env(dbname)
try:
result = subprocess.run(cmd, env=env, capture_output=True, text=True)
if result.returncode == 0:
size = os.path.getsize(backup_path)
print(f"Backup created: {backup_path} ({size:,} bytes)")
The restore operation always uses --clean, which drops existing database objects, yet the CLI provides no explicit warning, dry-run mode, or confirmation gate before destructive execution. In a database administration skill, this is more dangerous because users are likely to run it against production-like systems and may assume restore is non-destructive or reversible.
The script executes any SQL string passed via the --query argument directly with cur.execute(query), including write, schema-changing, and potentially destructive statements. In the context of an agent skill, this is dangerous because an LLM or downstream caller could be induced to run DROP, UPDATE, DELETE, COPY, or privilege-altering commands without any confirmation, policy checks, or restriction to read-only queries.
The manifest description presents activation cues in Chinese, such as "用户提到" and several Chinese trigger terms, while the rest of the document is primarily in English. This may impose a language-specific activation policy without explicit user opt-in or documented justification.
The manifest instructs users to supply database credentials via environment variables but gives no privacy or credential-handling guidance. In practice, this can lead to secret exposure through logs, shell history, subprocess inheritance, debugging output, or accidental disclosure in backups and exported artifacts.
The entire skill content is presented in Chinese, with no indication that language choice is configurable or that the resource is intentionally scoped to a Chinese-speaking audience. Per the policy rule, forcing a specific language without user opt-in can be a natural-language policy issue.
This code writes the exported schema to an arbitrary output file, and schema metadata can reveal table names, column names, defaults, and relationships that may be sensitive in some environments. Although the script prints a success message after writing, there is no prior user-facing warning in the code comments, docstring, or interface about the sensitivity of the exported content.
No suspicious patterns detected.