Skills neon-postgres

📦

neon-postgres

Name: neon-postgres
Author: neondatabase

Content revision r2 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Build Reliable Neon Postgres Workflows

Neon projects require careful choices for connections, migrations, scaling, and recovery. This skill provides focused guidance for dependable Postgres workflows on Neon.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "neon-postgres" from https://skillstore.io/skills/neondatabase-neon-postgres.md and its manifest at https://skillstore.io/api/skills/neondatabase-neon-postgres/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/neondatabase-neon-postgres.md Signed manifest GET /api/skills/neondatabase-neon-postgres/manifest Signed lockfile GET /api/skills/neondatabase-neon-postgres/lockfile

Test it

Using "neon-postgres". Which connection should a serverless web application use?

Expected outcome:

Use the pooled connection for normal application queries. Keep the direct connection available for migrations and session-dependent operations.

Using "neon-postgres". How should I test a schema migration before production?

Expected outcome:

Create a branch from production data.
Run the migration through a direct connection.
Validate application behavior and rollback procedures.
Apply the reviewed migration to production.

Using "neon-postgres". Can read replicas reduce primary read load?

Expected outcome:

Yes. Neon read replicas provide independent read-only compute while sharing storage with the primary branch.

Security Audit

High Risk

v5 • 8/9/2026 Open versioned report

Most detections are false positives caused by Markdown backticks, variable names, and links to official Neon documentation. Confirmed risks are unpinned remote skill installation and CLI-driven database credential handling; no prompt injection or exfiltration intent was found.

Files scanned

177

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:40

Environment file access

Use the CLI (default), `neon env pull`, or the MCP server to get the connection string. Store it in

Line 40 directs the agent to read and modify .env while storing a database credential. Mishandling could overwrite configuration or expose the secret.

Medium

SKILL.md:20-24 SKILL.md:84-88

Unpinned Remote Skill Installation

The skill directs agents to fetch or install mutable remote instructions without requiring review, integrity verification, or user confirmation.

Both passages explicitly offer remote SKILL.md retrieval or npx installation from an unpinned source. The source appears legitimate, but content can change after audit.

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:40

Database connection strings

Use the CLI (default), `neon env pull`, or the MCP server to get the connection string. Store it in

Line 40 explicitly retrieves a database connection string and stores it as DATABASE_URL in .env. This handles a live database credential.

Medium

SKILL.md:22-24

Ruby/shell backtick execution

```bash

Lines 22-24 direct the agent to run an npx installer from an unpinned remote package. This executes external code and changes installed skills.

Medium

SKILL.md:40

Ruby/shell backtick execution

Use the CLI (default), `neon env pull`, or the MCP server to get the connection string. Store it in

Line 40 instructs the agent to invoke Neon tooling to retrieve a connection string and modify .env. The command handles credentials and changes a local file.

Medium

SKILL.md:86-88

Ruby/shell backtick execution

```bash

Lines 86-88 direct the agent to run an npx installer for another unpinned skill. This executes external code and changes installed skills.

Medium

SKILL.md:94

Ruby/shell backtick execution

Use a **direct (non-pooled)** connection string when you run the migration, not a pooled one. `neon

Line 94 recommends invoking the Neon CLI to return a direct database connection string. The command accesses a live service and produces credential material.

Low

SKILL.md:20

Hardcoded URL

If the `neon` skill is not installed, fetch it from https://neon.com/docs/ai/skills/neon/SKILL.md or

Line 20 instructs the agent to fetch executable skill instructions from a remote URL. The trusted domain reduces risk, but mutable remote content remains a supply-chain boundary.

Low

SKILL.md:84

Hardcoded URL

For detailed branch creation workflows (normal vs schema-only branches, reset-from-parent, CLI/MCP s

Line 84 instructs the agent to fetch another skill file from a remote URL. Loading mutable instructions introduces a supply-chain and prompt-content risk.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/neondatabase-neon-postgres/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/neondatabase-neon-postgres/security.svg)](https://skillstore.io/skills/neondatabase-neon-postgres?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/neondatabase-neon-postgres?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/neondatabase-neon-postgres/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/neondatabase-neon-postgres.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

neondatabase. (2026). neon-postgres security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/neondatabase-neon-postgres/audits/5

BibTeX citation

@techreport{neondatabase-neondatabase-neon-postgres-2026,
  author = {neondatabase},
  title = {neon-postgres security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/neondatabase-neon-postgres/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "neon-postgres security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "neondatabase"
date-released: "2026-08-09"
url: "https://skillstore.io/skills/neondatabase-neon-postgres/audits/5"
identifiers:
  - type: other
    value: "skillstore:neondatabase-neon-postgres:audit:5"
    description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

Asmayaseen Recommended

asmayaseen-neon-postgres

Skillstore Score 78

Evidence Confidence High

Skillstore usage 9

Updated

2026-08-21

neondatabase Current

neondatabase-neon-postgres

Skillstore Score 38

Evidence Confidence High

Skillstore usage 8

Updated

2026-08-21

sickn33

sickn33-neon-postgres

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Configure a Serverless Application

Select a compatible driver and pooled connection strategy for a deployed application.

Test a Production Migration

Create an isolated branch and plan migration testing with a direct connection.

Plan Database Operations

Evaluate scaling, recovery, replicas, access controls, and replication for production requirements.

Try These Prompts

Choose a Connection

Help me connect [application] on [runtime] to Neon. Recommend the driver and pooled or direct connection, then explain the choice.

Plan a Migration

Plan a safe [ORM] schema migration for my Neon project. Include branch testing, connection type, validation, and production rollout steps.

Tune Scaling

Review this workload profile: [details]. Recommend Neon autoscaling, scale-to-zero, pooling, and read replica settings with trade-offs.

Design Production Architecture

Design a Neon Postgres architecture for [system]. Cover branching, migrations, recovery, access controls, pooling, replicas, and logical replication.

Best Practices

Use pooled connections for application traffic and direct connections for migrations, dumps, and replication.
Test schema changes on a production branch before applying them to production.
Store connection strings securely and exclude environment files from version control.

Avoid

Do not run migration tools through a pooled transaction-mode connection.
Do not mix manual schema changes with ORM-managed migration history.
Do not place database connection strings in prompts, logs, or source control.

Frequently Asked Questions

Does this skill create Neon projects?

It guides project selection and creation through Neon CLI or MCP when those tools are available.

Which connection should web applications use?

Most web and serverless applications should use the pooled connection for normal query traffic.

Which connection should migrations use?

Migrations should use the direct connection because transaction pooling does not preserve required session behavior.

Does this skill support Neon branches?

Yes. It explains branch use cases and directs detailed branch creation to the related branch skill.

Can it recommend a database driver?

Yes. Recommendations cover node-postgres, Neon serverless drivers, and several deployment runtimes.

Does it manage credentials safely?

It recommends local environment storage, but users must control permissions, version control exclusions, and secret handling.

Developer Details

Author

neondatabase

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/neondatabase/agent-skills/tree/main/skills/neon-postgres/

Ref

2bde2e0e5eff3944f4816404977245fa456a3b33

Maintenance freshness

8/11/2026

Usage

7 downloads · 182 views

File structure

📄 SKILL.md