Security audit
Security checks across malware telemetry and agentic risk
This is a disclosed PostgreSQL DBA tool that can make real database changes, but those capabilities fit its stated purpose and are not hidden.
Install only if you intend to let an agent inspect or operate PostgreSQL. Start with a read-only or pg_monitor-style role, and grant write/DDL privileges only for targets where agent-driven maintenance is acceptable. Protect POSTGRES_AIOPS_MASTER_PASSWORD like any other secret, and remember that the tool records and previews operations but does not itself decide whether a write is allowed.
- The password is **never** written to disk in plaintext. It lives only in `~/.postgres-aiops/secrets.enc`, encrypted with Fernet (AES-128-CBC + HMAC), the key derived from your master password via scrypt. Only a per-store random salt and the ciphertext are on disk (chmod 600); the master password itself is never stored. - A legacy plaintext env var `PG_<TARGET_NAME_UPPER>_PASSWORD` is still honoured as a fallback with a deprecation warning — migrate with `postgres-aiops secret
Use this skill whenever the user needs to operate or troubleshoot a PostgreSQL server/cluster as a DBA — a one-shot cluster health overview; server reads (version/uptime, settings, extensions, databases, roles); activity (sessions, idle-in-transaction, long-running queries, locks); query stats (pg_stat_statements top-N, EXPLAIN a statement); index health (unused indexes, missing-index hints, bloat, invalid/duplicate); table health (sizes, dead-tuple bloat, autovacuum status); replication (standby lag, replication slots, WAL); three flagship analyses — slow-query RCA (worst pg_stat_statements entry + EXPLAIN → cause/action), bloat & vacuum analysis (dead tuples + autovacuum lag → recommendation), and blocking lock-chain RCA (build the wait-for tree, name the root blocker); and guarded writes (terminate a backend, cancel a query, VACUUM/ANALYZE, create/drop an index, REINDEX, ALTER SYSTEM SET a parameter, reset query stats). Always use this skill for "postgres health check", "why is this query slow", "pg_stat_statements top queries", "EXPLAIN this", "table/index bloat", "which indexes are unused", "missing index", "autovacuum status", "who is blocking whom", "kill the backend holding the lock", "replication lag", "replication slots", "VACUUM this table", "create/drop an index", or "ALTER SYSTEM SET work_mem" when the context is a PostgreSQL database. Do NOT use when the target is OT / industrial equipment (Modbus, OPC-UA, PLCs — use industrial-aiops), a hypervisor, a storage appliance, a backup product, a container/cluster orchestrator, or a non-PostgreSQL database (negative routing hints only). Covers common PostgreSQL DBA operations with a built-in governance harness (audit, token budget, undo, risk-tiers). Beyond the mock suite, the reads plus a governed write and its undo have been exercised against a live PostgreSQL 16.14 instance (see docs/VERIFICATION.md). installer: kind: uv package: postgres-aiops
2. `postgres-aiops table autovacuum` → check whether autovacuum is simply behind (last run, thresholds) before doing it by hand 3. `postgres-aiops remediate vacuum <table> --analyze --dry-run` → preview; then run for real to `VACUUM ANALYZE` (double confirmation) 4. `postgres-aiops index unused` and `postgres-aiops index bloat` → find indexes that cost writes and return nothing 5. `postgres-aiops remediate drop-index <name> --concurrently --dry-run`, then for real → the tool captures `pg_get_indexdef` **before** dropping and records an inverse recreate descriptor 6. **Failure branch**: dropped the wrong index — `postgres-aiops undo apply <id>` recreates it from the captured definition (not a guess). Note `--full` on `remediate vacuum` takes an **exclusive lock** and rewrites the table; it has no undo, so never reach for it as a first response on a live table. ### Break a blocking pile-up during an incident
64/64 vendors flagged this skill as clean.
Detected: suspicious.prompt_injection_instructions
