Postgres Job Queue

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:32 PM UTC
• Version: 1.0.0

Overview

The skill content itself is a straightforward PostgreSQL job-queue guide, but its primary install command uses an unpinned remote npx/GitHub installer that deserves review before use.

Review the install path before installing. Prefer the manual per-project copy or an immutable, pinned release/commit instead of the documented unpinned `npx add` command. The skill's PostgreSQL guidance appears ordinary and purpose-aligned, but global installation makes it available across projects.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:23

Finding

Unpinned Third-Party Installer Can Execute Mutable Remote Code

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 23-25
Vulnerability Type: Supply-chain risk through an unpinned npm installer and mutable GitHub source
Risk Level: Medium

Vulnerable Code:

bash

npx add https://github.com/wpank/ai/tree/main/skills/backend/postgres-job-queue

Technical Analysis

The installation command invokes npx, which can download and execute the third-party npm package named add. No exact package version or integrity hash is specified. The content supplied to that installer is also referenced through a mutable GitHub path rather than an immutable, reviewed commit.

Consequently, the code executed during installation may differ from the content reviewed during this audit. Compromise of the npm package, its publisher account, the GitHub account, or the referenced upstream branch could introduce attacker-controlled behavior without requiring any change to this repository.

Attack Path

1. An attacker compromises the npm package, its publisher account, the GitHub repository, or another relevant upstream distribution channel.
2. The attacker publishes malicious installer logic or modifies content available through the mutable GitHub reference.
3. A user follows the documented installation instructions and runs the npx add ... command.
4. npx retrieves and executes the affected third-party package.
5. The malicious installer executes with the privileges and environment access of the user running the command.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, attacker code could read or modify accessible files, steal credentials or environment variables, alter development projects, install additional malicious components, or access resources available to the user. System-wide compromise would require the command to be run with elevated pr ...[truncated 49 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use an implicitly resolved npx package for simple file installation.
• Pin every required npm package to an exact, reviewed version and use lockfiles or integrity verification where applicable.
• Pin the GitHub source to an immutable commit hash rather than a mutable branch or directory URL.
• Prefer downloading an archive without executing remote installer code, verifying its published cryptographic checksum or signature, and copying only the audited files.
• Publish and document expected checksums for each approved release.
• If an installer is unavoidable, review its source, constrain its permissions, run it in an isolated environment, and avoid invoking it with administrative privileges.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to install the skill via npx add from a GitHub URL without any version pinning, commit hash, or integrity verification. That creates a supply-chain risk: if the referenced repository changes or is compromised later, users may install different content than originally reviewed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/backend/postgres-job-queue .cursor/skills/postgres-job-queue

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/backend/postgres-job-queue .claude/skills/postgres-job-queue

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/backend/postgres-job-queue ~/.claude/skills/postgres-job-queue

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: postgres-job-queue
model: standard
description: PostgreSQL-based job queue with priority scheduling, batch claiming, and progress tracking. Use when building job queues without external dependencies. Triggers on PostgreSQL job queue, background jobs, task queue, priority queue, SKIP LOCKED.
---

Static analysis

No suspicious patterns detected.