Security audit
Security checks for vulnerabilities and agentic risk
This PostgreSQL queue skill is mostly documentation, but it asks for broad write and command execution capability without tightly limiting when those powers should be used.
Review before installing. Use this only for PostgreSQL job-queue design or explicitly approved database work, and do not let it run shell commands, network checks, callbacks, or database mutations unless you intentionally requested that action and understand the target environment.
The skill presents itself as a knowledge-base assistant, but the content expands its scope into create/query/export operations and command-driven diagnostics. This mismatch can cause an agent or user to grant broader operational trust than intended, increasing the chance of unintended database changes or shell-assisted actions under the guise of documentation-only behavior.
The trigger condition is overly broad, covering general data-analysis and reporting scenarios far beyond the stated queue-design purpose. Overbroad activation increases the likelihood that the skill is invoked in unrelated contexts, where its operational hints and tool permissions may produce confusing, unsafe, or unnecessary actions.
The document claims no extra dependencies and describes itself as a pure knowledge-base skill, yet other sections instruct environment validation, connectivity checks, and real-world diagnostics. This inconsistency can mislead execution frameworks into enabling external interactions that users would not expect from a supposedly passive advisory skill.
The error-handling guidance introduces ping-based network diagnostics and firewall/proxy troubleshooting, which are outside the core purpose of PostgreSQL queue design guidance. Even if framed as troubleshooting, this broadens the skill into host and network probing behavior, which can be abused for reconnaissance or trigger unsafe command execution in connected agent environments.
No suspicious patterns detected.
