ClawHub
Back to skill

Security audit

Neon

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Neon CLI reference skill, but it can affect real cloud databases if used with valid Neon credentials.

Install only if you want an agent to help manage Neon resources. Use least-privilege Neon credentials, treat connection strings and API keys as secrets, and require explicit confirmation before any delete or reset command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents multiple destructive operations such as deleting projects, branches, databases, and roles, plus branch resets, without any warning to require explicit user confirmation, scope verification, or backup checks. In an agent setting, this increases the chance of accidental destructive execution from ambiguous prompts or mistaken identifiers, leading to data loss or service disruption.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The skill instructs users to authenticate and also documents an `--api-key` flag, but provides no warning about sensitive credential handling, logging, shell history exposure, or avoiding echoing secrets back to the user. In agent workflows, this can lead to accidental disclosure of API keys in prompts, terminal history, transcripts, or JSON output.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.