Skills neon-postgres

📦

neon-postgres

Name: neon-postgres
Author: sickn33

Content revision r2 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Build with Neon Serverless Postgres

Choosing safe Neon connection and deployment patterns can be difficult across runtimes. This skill guides setup, drivers, branching, authentication, scaling, and automation using current Neon documentation.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "neon-postgres" from https://skillstore.io/skills/sickn33-neon-postgres.md and its manifest at https://skillstore.io/api/skills/sickn33-neon-postgres/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-neon-postgres.md Signed manifest GET /api/skills/sickn33-neon-postgres/manifest Signed lockfile GET /api/skills/sickn33-neon-postgres/lockfile

Test it

Using "neon-postgres". Choose a Neon connection method for a Netlify function that handles one request per isolated instance.

Expected outcome:

Use the Neon serverless driver over HTTP because the runtime cannot reuse a persistent pool.
Keep DATABASE_URL in the deployment secret store and never include it in source control.
Test connection behavior and cold starts in the deployed environment.

Using "neon-postgres". Plan preview database branches for pull requests with controlled cost.

Expected outcome:

Create one branch per preview and apply migrations before application tests.
Set a short expiration policy for non-production branches and protect the default branch.
Review the configuration plan before applying changes, then remove branches after previews close.

Using "neon-postgres". Improve a Vercel application that creates too many Postgres connections.

Expected outcome:

Create one small node-postgres pool at module scope and reuse it across requests.
Attach the pool to the Vercel runtime so idle connections drain before suspension.
Monitor connection usage and adjust pool size against the Neon endpoint limit.

Security Audit

High Risk

v5 • 8/4/2026 Open versioned report

Most static alerts are false positives caused by Markdown backticks, code fences, official links, and standard process.env examples. Confirmed risks are unattended remote installation, cloud-changing Neon CLI commands, and instructions to inspect .env files containing database credentials. No prompt injection or exfiltration intent was found.

Files scanned

385

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:93

Environment file access

Use MCP server or CLI to get the connection string. Store it in `.env` as `DATABASE_URL`. Read the f

The instructions call for reading or checking an .env file that holds DATABASE_URL, so database credentials may enter the agent context during setup.

High

SKILL.md:114

Environment file access

If resuming setup, check what's already configured (MCP connection, `.env` with `DATABASE_URL`, depe

The instructions call for reading or checking an .env file that holds DATABASE_URL, so database credentials may enter the agent context during setup.

Capability review items (14)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:93

Database connection strings

Use MCP server or CLI to get the connection string. Store it in `.env` as `DATABASE_URL`. Read the f

The setup flow instructs the agent to inspect an .env file containing DATABASE_URL, which can expose a live database credential in the agent context.

High

SKILL.md:114

Database connection strings

If resuming setup, check what's already configured (MCP connection, `.env` with `DATABASE_URL`, depe

The setup flow instructs the agent to inspect an .env file containing DATABASE_URL, which can expose a live database credential in the agent context.

Medium

SKILL.md:67

Ruby/shell backtick execution

Offer to inspect existing connected Neon projects or create new ones using the Neon CLI or MCP serve

The skill directs npx with automatic confirmation to install and run the latest Neon CLI, which executes unpinned remote package code and initiates account authorization.

Medium

SKILL.md:69-71

Ruby/shell backtick execution

```bash

The command runs neon@latest through npx with -y, so remote unpinned code executes without an installation confirmation.

Medium

SKILL.md:75-77

Ruby/shell backtick execution

This installs the Neon extension (for Cursor/VS Code) or MCP server (for other agents), creates an A

The described init operation installs integrations, creates an API key, and changes project configuration, giving the external command security-sensitive side effects.

Medium

SKILL.md:77-79

Ruby/shell backtick execution

If `init` is not suitable, the individual steps can be run non-interactively:

This section explicitly introduces non-interactive installation commands, which can modify global agent configuration without a separate confirmation.

Medium

SKILL.md:80-81

Ruby/shell backtick execution

- **MCP server:** `npx -y add-mcp https://mcp.neon.tech/mcp -g -n Neon -y -a <agent-name>`

The command runs add-mcp through npx with -y and installs a remote Neon MCP endpoint globally, creating a supply-chain and account-access risk.

Medium

SKILL.md:81-93

Ruby/shell backtick execution

- **Agent skill:** `npx skills add neondatabase/agent-skills --skill neon-postgres --agent <agent-na

The command installs a remote agent skill through npx with automatic confirmation, so repository content is added without an explicit review step.

Medium

SKILL.md:182-193

Ruby/shell backtick execution

Use this for local development enablement with `npx -y neon@latest init --agent <agent-name>`, VSCod

The recommended npx setup runs the latest Neon package and configures development integrations, which executes remote code and changes agent configuration.

Medium

SKILL.md:262

Ruby/shell backtick execution

Reconcile the declaration from the CLI — the Neon equivalent of `terraform plan` / `apply`:

The prose directs users toward Neon plan and apply commands; apply changes live cloud service and compute settings.

Medium

SKILL.md:264-268

Ruby/shell backtick execution

```bash

This command block includes neon config apply, which can provision services and alter live branch compute settings after the preceding dry run.

Medium

SKILL.md:268-269

Ruby/shell backtick execution

neon deploy # alias for `neon config apply`

The neon deploy alias applies declared configuration to live Neon resources, so execution has material cloud-side effects.

Medium

SKILL.md:271

Ruby/shell backtick execution

Because `neon checkout` applies the policy as it **creates** a branch, a fresh branch comes up with

The instructions state that neon checkout and neon deploy create or reconcile cloud resources, making command execution operationally consequential.

Medium

SKILL.md:305-307

Ruby/shell backtick execution

```bash

The command invokes npx to fetch and install another remote skill, extending the trusted instruction set with content not audited in this report.

Risk Factors

⚙️ External commands (50)

🌐 Network access (35)

🔑 Env variables (12)

SKILL.md:141 SKILL.md:153 SKILL.md:164 SKILL.md:141 SKILL.md:153 SKILL.md:164 SKILL.md:62 SKILL.md:93 SKILL.md:114 SKILL.md:141 SKILL.md:153 SKILL.md:164

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-neon-postgres/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-neon-postgres/security.svg)](https://skillstore.io/skills/sickn33-neon-postgres?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-neon-postgres?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-neon-postgres/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-neon-postgres.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). neon-postgres security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-neon-postgres/audits/5

BibTeX citation

@techreport{sickn33-sickn33-neon-postgres-2026,
  author = {sickn33},
  title = {neon-postgres security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-neon-postgres/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "neon-postgres security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-08-04"
url: "https://skillstore.io/skills/sickn33-neon-postgres/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-neon-postgres:audit:5"
    description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

Asmayaseen Recommended

asmayaseen-neon-postgres

Skillstore Score 78

Evidence Confidence High

Skillstore usage 9

Updated

2026-08-21

neondatabase

neondatabase-neon-postgres

Skillstore Score 38

Evidence Confidence High

Skillstore usage 8

Updated

2026-08-21

sickn33 Current

sickn33-neon-postgres

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Connect a web application

Choose a compatible driver, configure DATABASE_URL, add an ORM, and apply safe pooling for the deployment runtime.

Design preview environments

Plan isolated Neon branches, migration testing, expiration policies, and deployment integration for development teams.

Scale a Postgres workload

Evaluate autoscaling, scale-to-zero, read replicas, recovery, and logical replication for production requirements.

Try These Prompts

Choose a connection

Review my [framework] application deployed on [platform]. Recommend the correct Neon driver, environment variables, and a safe setup checklist.

Add database branching

Design a Neon branching workflow for [team and deployment platform]. Include branch creation, migration testing, expiration, and cleanup steps.

Configure production access

Recommend pooling, role permissions, IP restrictions, and secret handling for this [runtime and traffic profile]. Explain operational trade-offs.

Audit a Neon architecture

Audit this Neon architecture for connection limits, pooling, autoscaling, scale-to-zero, recovery, and least privilege. Cite current official documentation for every recommendation.

Best Practices

Verify commands and product behavior with current official Neon documentation.
Keep credentials in environment variables, redact secret values, and use least-privilege database roles.
Review plans and request approval before installing packages or changing cloud resources.

Avoid

Do not commit connection strings, API keys, or populated environment files.
Do not create a new connection pool for every request in a shared runtime.
Do not run unpinned installation or cloud-changing commands without reviewing their source and effects.

Frequently Asked Questions

Which runtimes can use this skill?

It covers persistent servers, shared serverless runtimes, isolated functions, edge runtimes, and applications using standard Postgres tools.

Does the skill create a Neon account?

No. It can guide CLI or MCP authorization, but the user must control account access and approve setup.

Can it choose between node-postgres and the Neon serverless driver?

Yes. It bases the recommendation on connection reuse, transport support, runtime isolation, and deployment constraints.

Does it support database branching?

Yes. It explains branch creation, preview workflows, migration testing, expiration, reset, and restore concepts.

Can it safely handle DATABASE_URL?

It recommends environment variables and redaction. Users should prevent secret display, confirm file changes, and use least-privilege credentials.

Are the included commands always current?

No. Neon packages, APIs, pricing, and CLI behavior can change, so commands require verification before execution.

Developer Details

Author

sickn33

License

Apache-2.0

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/neon-postgres

Ref

81e05e636292629114b76cbb3922fbe57672fc02

Maintenance freshness

8/5/2026

Usage

9 downloads · 167 views

File structure

📄 SKILL.md