Security audit

PlanetScale CLI Skills

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate PlanetScale CLI skill, but it needs review because it can guide or automate production database changes, deletions, and credential operations with some broad triggers and uneven confirmation guidance.

Review this before installing in an agent that can run commands. It is not deceptive, but it can affect live PlanetScale databases and credentials. Use it only when you want PlanetScale CLI administration, require explicit approval before deploy/delete/revert/promote/routing/password/token actions, and avoid broad auto-routing from generic database or login requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger description is very broad and includes generic terms like database branches, schema migrations, SQL queries, and terminal operations. This can cause the skill to activate in contexts beyond PlanetScale-specific tasks, increasing the chance an agent follows high-impact database guidance or executes pscale-related workflows when the user intended a different database tool or environment.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The manifest description includes very broad trigger terms such as "auth," "login," "logout," "authentication," and "credentials," which can cause the skill to activate in contexts beyond PlanetScale CLI usage. Overbroad activation increases the chance that unrelated sensitive credential workflows are routed into this skill, potentially exposing users to inappropriate handling of authentication or secrets in the wrong context.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list includes broad terms such as 'backup' and 'restore', which are common words that can appear in many unrelated contexts. In an agent-routing system, this can cause unintended invocation of a skill that suggests or enables database backup operations when the user did not intend PlanetScale CLI actions, increasing the chance of inappropriate or risky command guidance.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation presents `pscale backup delete` as a normal workflow step without any warning that it is destructive and may permanently remove recovery points. In an operational CLI skill focused on production database management, omission of cautionary guidance increases the likelihood of accidental data-loss actions by users or downstream agents following the instructions verbatim.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger list includes very broad terms like `branch` and `create branch`, which can cause this skill to activate for unrelated user requests. In an agentic system, over-broad routing can expose users to destructive database-branch operations or cause the agent to suggest or execute PlanetScale commands in the wrong context.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: `pscale branch delete` is documented in the common command list without an adjacent warning, confirmation requirement, or explicit statement that it is destructive. In an automation or agent setting, terse destructive examples can be copied or executed without adequate review, risking irreversible deletion of development or production-adjacent database branches.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The command `pscale branch promote` appears in the common command list without an immediate warning, despite promoting a branch to production being a high-impact operational change. Even though later sections recommend deploy requests, the early example may encourage direct production promotion in contexts where an agent or operator acts on the first visible command.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: `pscale branch routing-rules update` changes routing behavior but is presented without a nearby warning or confirmation guidance. Misapplied routing rules can redirect traffic incorrectly, disrupt application behavior, or create outages, especially in Vitess or production-like environments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The troubleshooting section advises demoting and then deleting a branch when deletion fails due to protection or production status, but it does so without warning about production impact or requiring confirmation. That guidance could normalize removing protections from a production branch as a routine fix, leading to severe service disruption or accidental data-path changes.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: `pscale branch resize` changes database cluster size and can affect cost, capacity, and possibly service behavior, yet the reference gives no warning about operational impact or need for explicit user confirmation. In an agent setting, omission of a cautionary prompt increases the chance of unintended expensive or disruptive changes.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: Updating routing rules can redirect production traffic and break application behavior if misapplied. Because the reference omits an impact warning and confirmation guidance, an agent could treat it as a routine action and make a dangerous configuration change without adequate safeguards.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Creating a MoveTables workflow can initiate major data-movement and topology changes, especially with `--auto-start` enabled by default. Without a prominent warning or approval checkpoint, an agent may trigger large-scale operational changes that are hard to reverse and may impact data consistency or availability.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrase "database" is excessively broad for a skill-routing description and can cause this skill to activate for many unrelated requests involving databases generally, not specifically PlanetScale database management. In an agentic environment, over-triggering can route users into high-impact operational guidance unexpectedly, increasing the chance of unsafe or destructive command suggestions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill includes a destructive deletion command for databases without any adjacent warning, confirmation guidance, or note that the action is irreversible. In a CLI reference skill intended to guide terminal operations, this omission increases the likelihood that users or downstream agents execute data-destroying commands without adequate caution.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents production-affecting commands such as deploy and revert without placing an explicit warning adjacent to those commands about their irreversible or service-impacting consequences. In an automation-oriented agent context, concise command references can be copied or executed with insufficient human review, increasing the chance of accidental production schema changes or rollback actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The automation example includes an --auto-approve flag for schema deployment without a strong warning that it bypasses manual review and approval safeguards. In a skill intended for agent-assisted terminal workflows, this can normalize or encourage unattended production deployments, raising the risk of destructive schema changes, outages, or data integrity issues from mistaken branch selection or unreviewed diffs.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list includes very broad terms like "org" and "organization," which can cause the skill to activate in many unrelated contexts. This increases the chance of incorrect routing and unintended command guidance in conversations that are not specifically about PlanetScale organizations.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The workflow normalizes creation and immediate display/use of connection strings containing credentials without warning users that these secrets must not be logged, pasted into shared terminals, or committed to shell history and source control. In a credential-management skill, omission of secret-handling guidance increases the likelihood of accidental exposure of database access credentials.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The troubleshooting section recommends deleting and recreating passwords with no warning that deletion can immediately break applications or automation still using that credential. In a production database context, presenting destructive credential rotation steps without confirmation or impact checks can cause avoidable outages and disrupt access.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill walks users through creating service tokens, exposing the returned TOKEN/TOKEN_ID and immediately wiring them into CI/CD, but the workflow section does not prominently warn that the token value is a sensitive secret visible only at creation time and must never be logged, pasted into chat, or stored in plaintext. It also instructs deletion of old tokens during rotation without warning about validating cutover first, which can break active pipelines or deployments if the old token is still in use.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger text is broad enough to activate on general terms like 'PlanetScale SQL query', 'non-interactive query', and '--query', which can cause this skill to be selected in contexts beyond narrowly scoped safe read operations. In an agent setting, over-broad routing increases the chance that SQL-capable guidance is surfaced for ambiguous requests, potentially enabling unintended database access patterns or destructive follow-on actions if other safeguards fail.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: echo "" # Step 3: Deploy if requested if [[ "$AUTO_DEPLOY" == true ]]; then echo "🚀 Deploying..." pscale deploy-request deploy "$DATABASE" "$DR_NUMBER" "${ORG_ARGS[@]}" echo "✅ Deployment complete!"
Confidence: 78% confidence
Finding: AUTO_DEPLOY

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.