Security audit

postgres mcp

Security checks for vulnerabilities and agentic risk

Overview

This PostgreSQL management skill is purpose-aligned, but it asks users to connect live databases through credential-bearing configuration and unpinned third-party MCP components while enabling high-impact SQL operations.

Install only if you trust the postgres-mcp source and are prepared to grant database access. Use a dedicated least-privilege PostgreSQL role, prefer read-only mode, avoid production credentials in command lines or client config files, pin package/image versions where possible, and require explicit review before writes, DDL, index creation, backend termination, or scheduled automation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: reference/setup-postgres-mcp/setup-postgres-mcp.md:7
Finding: Unpinned Third-Party Package and Mutable Container Image
Content: View full analysis
Remediation: View remediation
" ``` 2. Pin the container by immutable digest rather than `latest`: ```text ghcr.io/crystaldba/postgres-mcp@sha256: ``` 3. Document the authoritative package repository, source repository, and container registry so users can detect similarly named or typosquatted packages. 4. Verify release signatures, image provenance, or published checksums before installation where supported. 5. Use an automated dependency-update process that requires review and testing before changing the pinned package version or image digest. 6. Run the MCP server with a dedicated least-privilege database role. Enable read-only mode unless mutation is explicitly required. 7. Restrict the local process or container using operating-system permissions, container isolation, resource limits, and a non-root runtime identity. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: reference/setup-postgres-mcp/setup-postgres-mcp.md:7
Finding: Database Credentials Exposed in Process Arguments and Plaintext Client Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The feature list advertises health checks, schema queries, and SQL execution but does not warn users that some operations may affect live databases, performance, or data integrity if misused. In a PostgreSQL management skill, missing safety guidance can lead operators to run impactful actions against production systems without understanding the risk, especially since the skill includes execution and optimization functionality.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs users to invoke a broad top-level command (/postgres) that automatically routes to different database-management functions, including SQL execution. In a skill with both read-only and potentially state-changing capabilities, an ambiguous trigger increases the chance of accidental invocation of higher-impact actions or user confusion about what permissions and operations will occur.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises itself for broad PostgreSQL- or database-related language, including generic phrases like 'database optimization' and 'query performance'. This can cause the agent to invoke a high-privilege skill in situations where the user may only be asking conceptual questions, increasing the chance of unnecessary database access or SQL execution paths being offered.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger text is broad enough to invoke this skill for almost any request involving SQL or data changes, which increases the chance the agent routes users into an execution-capable workflow prematurely. In the context of a tool that can perform database writes and schema changes, overbroad invocation materially raises the risk of unsafe or unintended operations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document states that write and high-risk operations require confirmation, but later sections provide directly usable mutating and administrative statements without repeating or enforcing that safeguard. This inconsistency can cause an agent or user to treat dangerous commands as routine examples, increasing the chance of unintended destructive changes or service disruption.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is framed as a 'safe SQL execution' tool, but it also documents administrative capabilities to cancel or terminate backend sessions. Those actions can disrupt legitimate workloads and amount to denial-of-service if invoked inappropriately, especially because they are presented as related commands without the same guardrails emphasized for risky write operations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation guidance is broad enough to match many generic PostgreSQL performance or optimization questions, not just health-check requests. Over-broad routing can cause the wrong skill to activate and perform unnecessary database inspection, which may expose metadata or lead to actions based on an incomplete fit for the user's intent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is described as a read-only health check workflow, but the example claims it can "set up scheduled task[s]" for recurring execution. That capability expansion can mislead an agent or user into attempting persistence or automation outside the documented scope, increasing the chance of unauthorized side effects in an environment expected to be observational only.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger text includes broad phrases like 'queries too slow' and 'need to add indexes', which can match common conversational language and cause the skill to activate outside a clearly scoped PostgreSQL administration context. Because this skill can lead to database inspection and potentially index creation guidance or execution, unintended invocation increases the chance of unnecessary access to database tooling and accidental operational changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation guidance says to use the skill when users ask 'why queries are slow,' 'how to optimize queries,' or 'analyze query performance,' which are broad natural-language triggers without clear boundaries or exclusions. In a markdown skill description, this can cause unintended activation for generic database-help requests rather than cases specifically requiring PostgreSQL execution-plan analysis.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description says to use the skill when users ask about table structure, field information, relationships, generating SQL, or what tables exist, which is a wide set of common database requests without explicit trigger constraints or exclusions. In a manifest-style markdown header, this broad wording can cause unintended invocation for everyday database conversations rather than a narrowly defined command scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly supports enumerating tables and other schema metadata, which can expose sensitive structural information such as internal table names, relationships, views, functions, and comments. In an agent setting, this can aid reconnaissance and accelerate later abuse if an unauthorized or over-broadly authorized user can trigger the skill without a clear warning, scoping control, or permission gate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation repeatedly shows full PostgreSQL connection URIs with inline usernames and passwords, including examples placed directly in shell commands and MCP config files. In this context, users may copy real credentials into command history, local configuration, screenshots, logs, or version-controlled files, increasing the chance of accidental credential disclosure and unauthorized database access.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.