Trust Assessment
postgres received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include SQL Injection via `psql` command execution.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | SQL Injection via `psql` command execution The skill's 'Commands' section demonstrates executing `psql` with a SQL query passed via the `-c` flag. The 'Usage Examples' section strongly implies that the SQL query part (e.g., 'SELECT * FROM users') is intended to be derived directly from untrusted user input. If the LLM directly embeds unsanitized user input into the `psql -c "..."` command, it creates a severe SQL injection vulnerability. An attacker could provide malicious SQL (e.g., `DROP TABLE users; --`) which would be executed by the `psql` command, potentially leading to data loss, unauthorized data access, or even remote code execution depending on the database configuration and `psql` version. The LLM must be explicitly instructed to strictly validate and sanitize any user-provided SQL queries before embedding them into the `psql -c` command. This could involve using a whitelist of allowed SQL commands/patterns, a dedicated SQL parsing library, or ensuring proper escaping of all user input to prevent injection. Direct execution of arbitrary user-provided SQL is highly dangerous and should be avoided. | LLM | SKILL.md:29 |
Scan History
Embed Code
[](https://skillshield.io/report/8d2b3da644615471)
Powered by SkillShield