{"data":{"skill":{"slug":"neondatabase-neon-postgres","name":"neon-postgres","icon":"📦","repo":"https://github.com/neondatabase/agent-skills/tree/main/skills/neon-postgres/","status":"approved","author":"neondatabase","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"1cc8eb0d-1b57-432e-9418-dbbc660328ca","skill_id":"d0af2ff2-de74-46d5-ad25-65e8445de86b","version":2,"content_hash":"6e49ffa88683eed2c0414857dd0dc7ec","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis flagged Markdown backticks, Neon documentation URLs, and text that resembled weak crypto or reconnaissance patterns. Review found no executable code, no prompt injection attempt, and no evidence of malicious intent. The remaining risk is expected network documentation access and optional Neon CLI guidance.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"SKILL.md","line_end":19,"line_start":18},{"file":"SKILL.md","line_end":31,"line_start":28},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":95,"line_start":95},{"file":"SKILL.md","line_end":103,"line_start":101},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":121,"line_start":121},{"file":"SKILL.md","line_end":133,"line_start":133},{"file":"SKILL.md","line_end":145,"line_start":145},{"file":"SKILL.md","line_end":157,"line_start":157},{"file":"SKILL.md","line_end":169,"line_start":169},{"file":"SKILL.md","line_end":175,"line_start":175},{"file":"SKILL.md","line_end":186,"line_start":186}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":113,"line_start":113}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Markdown Backticks Misclassified as Shell Execution","locations":[{"file":"SKILL.md","line_end":19,"line_start":18},{"file":"SKILL.md","line_end":29,"line_start":27},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":93,"line_start":87}],"confidence":0.93,"description":"Static execution findings point to Markdown formatting, package names, and documentation references. The reviewed file contains no script body, dynamic execution, or hidden shell payload.","confidence_reasoning":"The cited lines are Markdown guidance and inline command examples. There is no executable source file or user input interpolation at those locations."},{"title":"Expected Links to Official Neon Documentation","locations":[{"file":"SKILL.md","line_end":19,"line_start":18},{"file":"SKILL.md","line_end":31,"line_start":28},{"file":"SKILL.md","line_end":61,"line_start":37},{"file":"SKILL.md","line_end":103,"line_start":67},{"file":"SKILL.md","line_end":186,"line_start":115}],"confidence":0.9,"description":"The hardcoded URLs all reference neon.com documentation pages. Network access is part of the skill purpose, but users should understand that responses may fetch external documentation.","confidence_reasoning":"The reviewed links consistently target official Neon documentation. I found no non-Neon endpoint, webhook, paste site, or credential exfiltration pattern."},{"title":"High-Severity Static Blockers Are False Positives","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":166,"line_start":166},{"file":"SKILL.md","line_end":186,"line_start":186}],"confidence":0.86,"description":"The weak cryptography and system reconnaissance matches are prose, documentation paths, or a hostname suffix example. No cryptographic operation or host enumeration command is present.","confidence_reasoning":"The flagged lines describe docs, an index, connection pooling, and logical replication. They do not contain code that hashes, encrypts, scans hosts, or gathers system details."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":187,"audit_model":"codex","audited_at":"2026-06-30T08:00:53.831+00:00","created_at":"2026-06-30T10:03:21.910642+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":2,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}