PlanetScale CLI Skills

• Outcome: Review
• Latest audit: Sep 5, 2026 · 5:12 PM UTC
• Version: 1.0.22

Overview

This is a disclosed PlanetScale CLI operations skill, but it is broad enough to affect production databases, credentials, billing, and access controls, with some high-impact examples that are not consistently gated.

Install this only if you want an agent to help operate PlanetScale. Treat every create, update, delete, deploy, promote, --force, write SQL, billing, SSO, member, webhook, password, or service-token action as requiring explicit human approval after the exact org, database, branch, resource ID, and expected impact are shown. Keep secrets in environment variables or a secret manager, avoid raw billing/webhook/password output in logs or chat, and prefer read-only inspection commands first.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly states that automation scripts are executed directly via shell and includes numerous shell command examples, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: an agent or reviewer may underestimate that the skill can trigger state-changing CLI operations against PlanetScale infrastructure, including deploys, branch promotion, billing/payment-method actions, webhook management, and SQL execution.

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: The troubleshooting section recommends `pscale branch demote`, a command that is not established elsewhere in the skill and appears inconsistent with the documented branch lifecycle. In an operational database skill, an invented or incorrect destructive recovery step can cause operators to run invalid commands, misunderstand production-state transitions, or improvise unsafe alternatives under pressure.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger terms in the manifest are overly broad for a security-sensitive authentication skill. Generic words like "auth," "login," and especially "credentials" can cause the skill to activate in unrelated conversations, increasing the chance that user prompts containing secrets or account-access context are routed into this skill unexpectedly.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad generic terms such as "billing," "invoice," and "spend," which can cause the skill to be invoked in contexts that are not specifically about PlanetScale billing operations. That increases the chance of accidental routing into a sensitive skill that exposes billing workflows and private financial data handling guidance when a user intended something else.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The branch deletion command is presented in a common-commands section without adjacent approval or data-loss warnings. In an agent-consumable operational skill, prominently listing destructive commands without local safeguards increases the risk of accidental deletion, especially if a caller or downstream agent copies commands out of context.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The direct promotion command is shown as a simple common command without adjacent warning about production impact, review requirements, or preference for deploy requests. Even though later sections recommend deploy requests, this placement makes an irreversible or high-impact production action look routine and easy to execute out of context.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The troubleshooting advice suggests deleting an existing branch as a straightforward fix for a naming conflict, without warning about possible data loss or the need to verify that the branch is stale and safe to remove. Troubleshooting sections are often followed quickly during incidents, making unsafe shorthand especially risky in this context.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The best-practices item encourages deleting merged branches to keep the list clean, but omits verification and approval language. While lower risk than the explicit command examples, it still normalizes destructive cleanup behavior in a database-branching context where branches may retain valuable test state or recovery value.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documented `pscale branch routing-rules update` operation performs a write that can alter traffic routing for a branch, but the skill text does not add explicit warning, validation, or user-approval guidance around blast radius. In an agent context, omission of such guardrails increases the chance of misrouting production traffic or causing outages from an unintended file or target.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: `pscale branch vtctld apply-keyspace-routing-rules` replaces live keyspace routing rules, which can immediately change request routing in a running Vitess cluster. Because the skill documents it without approval, risk, or rollback guidance, an autonomous or inattentive agent could make disruptive live-routing changes with significant availability impact.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This reference documents state-changing and potentially destructive operations such as cancel, complete, internalize, and externalize, including an explicit '--delete' option, without any nearby warning about operational impact or irreversibility. In an agent skill context, terse command references can be used directly by automation or copied by users, increasing the chance of accidental production changes.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The skill documents a destructive command (`pscale keyspace delete`) and notes `--force` removes confirmation, but it does not prominently warn that deleting a keyspace is irreversible and operationally dangerous. In an agent skill context, concise reference text can be turned into autonomous destructive actions without sufficient friction or safety guidance.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest description includes a very broad set of trigger phrases spanning many high-risk production database operations, increasing the chance the skill is invoked in contexts where the user's intent is ambiguous or only partially related. Because this skill contains operational write actions such as deploy, revert, unblock, throttler updates, and force-cutover, overbroad routing can lead to inappropriate guidance for sensitive production changes.

Missing User Warnings

High

• Confidence: 89% confidence
• Finding: The force-cutover section explicitly states that it kills long-running transactions blocking table locks, but it does not present a prominent warning about disrupting active workloads or causing user-visible failures. In an agent skill context, documenting a destructive operational action without strong caution increases the chance an automated or hurried user will invoke it unsafely against production traffic.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger list includes very generic terms such as "org" and "organization," which can cause this skill to activate for unrelated user requests. In an agent setting, that misrouting is security-relevant because this skill contains guidance for organization membership, SSO, and other access-control operations, so accidental invocation could steer workflows toward sensitive administrative actions.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger list includes generic terms such as "password," "connection string," "CIDR," and "read-only replica," which are common in many unrelated contexts and can cause the skill to activate when the user did not intend to invoke PlanetScale password operations. In a credential-management skill, unintended invocation is more dangerous because it can steer the agent toward handling secrets, rotating credentials, or suggesting sensitive CLI actions in the wrong context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The password creation documentation describes how to create a branch credential but does not warn that the generated secret is typically only disclosed at creation time and must be captured securely immediately. In a credential-management skill, that omission can cause users or downstream agents to lose access material, retry insecurely, or mishandle secret storage during provisioning.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The renew command documentation omits that renewal exposes a new secret and can invalidate or supersede the old credential operationally, requiring immediate secure capture and dependent system updates. In a password-focused administrative skill, missing this warning increases the chance of secret loss, service disruption, and insecure ad hoc handling of replacement credentials.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document explicitly instructs use of sensitive authentication parameters such as --api-token, --service-token, and --service-token-id but provides no warning about secret handling, shell history exposure, logging, or safe storage. In an agent-skill context, this can lead users or automation to pass credentials on the command line where they may be exposed to process listings, transcripts, or debug output.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

delete, rm

Flags:
      --force   Delete a keyspace without confirmation
  -h, --help    help for delete

Global Flags:

• Confidence: 84% confidence
• Finding: `--force` explicitly bypasses confirmation for keyspace deletion, enabling non-interactive destructive execution. In an agent skill, that materially increases the chance of unintended autonomous deletion if the model composes commands from the reference without a human checkpoint.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

echo ""

# Step 3: Deploy if requested
if [[ "$AUTO_DEPLOY" == true ]]; then
  echo "🚀 Deploying..."
  pscale deploy-request deploy "$DATABASE" "$DR_NUMBER" "${ORG_ARGS[@]}"
  echo "✅ Deployment complete!"

• Confidence: 74% confidence
• Finding: When --deploy is supplied, the script performs an immediate deploy-request deployment after showing a diff, with no interactive confirmation, policy gate, environment check, or approval enforcement in the script itself. In a database schema workflow, this can amplify operator mistakes or unsafe automation and lead to unintended production schema changes.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

pscale org sso disable [flags]

Flags:
      --force   Disable SSO without confirmation
  -h, --help    help for disable

Global Flags:

• Confidence: 83% confidence
• Finding: The documented `--force` flag enables disabling organization SSO without confirmation, which can accelerate destructive or security-reducing actions if an agent executes it without explicit user approval. In an agent skill context, removing confirmation on identity controls is more dangerous because automated tooling may take irreversible action with less human scrutiny.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

pscale org sso directory disable [flags]

Flags:
      --force   Disable directory sync without confirmation
  -h, --help    help for disable

Global Flags:

• Confidence: 85% confidence
• Finding: The `--force` option for disabling directory sync removes a confirmation barrier for a change that can deprovision non-admin directory members. In agent-assisted use, this raises risk of unintended access disruptions or destructive identity-management changes being executed autonomously.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

delete, rm

Flags:
      --force   Delete the domain without confirmation
  -h, --help    help for delete

Global Flags:

• Confidence: 73% confidence
• Finding: Deleting an SSO domain without confirmation reduces safeguards around identity configuration changes and can break SSO domain associations if used incorrectly. In an automation or agent setting, lack of confirmation makes accidental destructive action more plausible.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

delete, rm

Flags:
      --force         Delete a password without confirmation
  -h, --help          help for delete
      --name string   Delete password by name instead of ID

• Confidence: 86% confidence
• Finding: Documenting a destructive credential-deletion flag that bypasses confirmation can be dangerous in an agent skill because automated consumers may favor non-interactive execution and remove active passwords without human review. In a credential-management context, that can abruptly break production access or accelerate accidental or unauthorized cleanup actions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.