Versioned security assessment

Report ID: SA-81E05E63

8/4/2026, 3:32:22 PM

neon-postgres security assessment v5

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
neon-postgres
Version
v5
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/neon-postgres
Coverage
1 Files scanned · 385 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are false positives caused by Markdown backticks, code fences, official links, and standard process.env examples. Confirmed risks are unattended remote installation, cloud-changing Neon CLI commands, and instructions to inspect .env files containing database credentials. No prompt injection or exfiltration intent was found.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 385 Lines analyzed

16 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 35 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Observed in 6 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (14)
High
SKILL.md:93
Database connection strings
Use MCP server or CLI to get the connection string. Store it in `.env` as `DATABASE_URL`. Read the f
The setup flow instructs the agent to inspect an .env file containing DATABASE_URL, which can expose a live database credential in the agent context.
High
SKILL.md:114
Database connection strings
If resuming setup, check what's already configured (MCP connection, `.env` with `DATABASE_URL`, depe
The setup flow instructs the agent to inspect an .env file containing DATABASE_URL, which can expose a live database credential in the agent context.
Medium
SKILL.md:67
Ruby/shell backtick execution
Offer to inspect existing connected Neon projects or create new ones using the Neon CLI or MCP serve
The skill directs npx with automatic confirmation to install and run the latest Neon CLI, which executes unpinned remote package code and initiates account authorization.
Medium
SKILL.md:69-71
Ruby/shell backtick execution
```bash
The command runs neon@latest through npx with -y, so remote unpinned code executes without an installation confirmation.
Medium
SKILL.md:75-77
Ruby/shell backtick execution
This installs the Neon extension (for Cursor/VS Code) or MCP server (for other agents), creates an A
The described init operation installs integrations, creates an API key, and changes project configuration, giving the external command security-sensitive side effects.
Medium
SKILL.md:77-79
Ruby/shell backtick execution
If `init` is not suitable, the individual steps can be run non-interactively:
This section explicitly introduces non-interactive installation commands, which can modify global agent configuration without a separate confirmation.
Medium
SKILL.md:80-81
Ruby/shell backtick execution
- **MCP server:** `npx -y add-mcp https://mcp.neon.tech/mcp -g -n Neon -y -a <agent-name>`
The command runs add-mcp through npx with -y and installs a remote Neon MCP endpoint globally, creating a supply-chain and account-access risk.
Medium
SKILL.md:81-93
Ruby/shell backtick execution
- **Agent skill:** `npx skills add neondatabase/agent-skills --skill neon-postgres --agent <agent-na
The command installs a remote agent skill through npx with automatic confirmation, so repository content is added without an explicit review step.
Medium
SKILL.md:182-193
Ruby/shell backtick execution
Use this for local development enablement with `npx -y neon@latest init --agent <agent-name>`, VSCod
The recommended npx setup runs the latest Neon package and configures development integrations, which executes remote code and changes agent configuration.
Medium
SKILL.md:262
Ruby/shell backtick execution
Reconcile the declaration from the CLI — the Neon equivalent of `terraform plan` / `apply`:
The prose directs users toward Neon plan and apply commands; apply changes live cloud service and compute settings.
Medium
SKILL.md:264-268
Ruby/shell backtick execution
```bash
This command block includes neon config apply, which can provision services and alter live branch compute settings after the preceding dry run.
Medium
SKILL.md:268-269
Ruby/shell backtick execution
neon deploy # alias for `neon config apply`
The neon deploy alias applies declared configuration to live Neon resources, so execution has material cloud-side effects.
Medium
SKILL.md:271
Ruby/shell backtick execution
Because `neon checkout` applies the policy as it **creates** a branch, a fresh branch comes up with
The instructions state that neon checkout and neon deploy create or reconcile cloud resources, making command execution operationally consequential.
Medium
SKILL.md:305-307
Ruby/shell backtick execution
```bash
The command invokes npx to fetch and install another remote skill, extending the trusted instruction set with content not audited in this report.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
SKILL.md:93
Environment file access
Use MCP server or CLI to get the connection string. Store it in `.env` as `DATABASE_URL`. Read the f
The instructions call for reading or checking an .env file that holds DATABASE_URL, so database credentials may enter the agent context during setup.
RISK-002 High
SKILL.md:114
Environment file access
If resuming setup, check what's already configured (MCP connection, `.env` with `DATABASE_URL`, depe
The instructions call for reading or checking an .env file that holds DATABASE_URL, so database credentials may enter the agent context during setup.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    The setup flow may read .env files containing database credentials.
    Check variable presence without displaying values, redact credentials, and update only DATABASE_URL while preserving existing file content.
  2. FIX-002
    Medium
    Unpinned packages run through npx with automatic confirmation.
    Pin package versions, verify package identity, and request explicit approval before installing CLI, MCP, extension, or skill components.
  3. FIX-003
    Medium
    Neon apply, deploy, checkout, and provisioning commands can change cloud resources.
    Show the plan and request explicit approval before resource creation, configuration application, authentication provisioning, or destructive actions.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
81e05e636292629114b76cbb3922fbe57672fc02
Content hash
7634a7bc02f27a850cc0750b32e16380d82907d436ee3ef6f5805d13a8638a4c
Tree hash
4f0cd6b02f91b5f009e684897aa9556f2168cf17225cc16ed562cf8f918da35b
Skill path
skills/sickn33/neon-postgres
Audit payload hash
60c174afd95c2525bf03e58616679aea

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active