pgmicro-postgres-sqlite

github.com/aradotso/trending-skills
Verdict: Proceed with caution
0 critical0 high16 medium
C
SCORE 55 / 100
$skillox install pgmicro-postgres-sqliteSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade C?

score · 55 / 100

The current grade reflects 16 medium findings (6+ MEDs → C).

0 CRIT0 HIGH16 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 11 of 16 MED (cap is 5).

  • A
    Reach Atarget score 95

    Resolve 14 of 16 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-lydhyflgqx3of73ub0k69ahe · Thu, 28 May 2026 17:23:26 GMT · 2ms

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 98CWE-78
▾
96
97// DDL
98await db.exec(`← spawns a subprocess outside declared capabilities
99 CREATE TABLE users (
100 id SERIAL PRIMARY KEY,
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 108CWE-78
▾
106
107// Insert
108await db.exec(`← spawns a subprocess outside declared capabilities
109 INSERT INTO users (name, email) VALUES ('Alice', 'alice@example.com')
110`);
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 122CWE-78
▾
120
121// Execute with bound parameters
122await db.exec("INSERT INTO users (name, email) VALUES (?, ?)", ["Bob", "bob@example.com"]);← spawns a subprocess outside declared capabilities
123
124await db.close();
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 134CWE-78
▾
132const db = await connect(":memory:");
133
134await db.exec(`← spawns a subprocess outside declared capabilities
135 CREATE TABLE events (
136 id SERIAL PRIMARY KEY,
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 167CWE-78
▾
165const db = await connect(":memory:");
166
167await db.exec("CREATE TABLE accounts (id INT PRIMARY KEY, balance INT)");← spawns a subprocess outside declared capabilities
168await db.exec("INSERT INTO accounts VALUES (1, 1000), (2, 500)");
169
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 168CWE-78
▾
166
167await db.exec("CREATE TABLE accounts (id INT PRIMARY KEY, balance INT)");
168await db.exec("INSERT INTO accounts VALUES (1, 1000), (2, 500)");← spawns a subprocess outside declared capabilities
169
170// Manual transaction
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 171CWE-78
▾
169
170// Manual transaction
171await db.exec("BEGIN");← spawns a subprocess outside declared capabilities
172try {
173 await db.exec("UPDATE accounts SET balance = balance - 100 WHERE id = 1");
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 173CWE-78
▾
171await db.exec("BEGIN");
172try {
173 await db.exec("UPDATE accounts SET balance = balance - 100 WHERE id = 1");← spawns a subprocess outside declared capabilities
174 await db.exec("UPDATE accounts SET balance = balance + 100 WHERE id = 2");
175 await db.exec("COMMIT");
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 174CWE-78
▾
172try {
173 await db.exec("UPDATE accounts SET balance = balance - 100 WHERE id = 1");
174 await db.exec("UPDATE accounts SET balance = balance + 100 WHERE id = 2");← spawns a subprocess outside declared capabilities
175 await db.exec("COMMIT");
176} catch (err) {
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 175CWE-78
▾
173 await db.exec("UPDATE accounts SET balance = balance - 100 WHERE id = 1");
174 await db.exec("UPDATE accounts SET balance = balance + 100 WHERE id = 2");
175 await db.exec("COMMIT");← spawns a subprocess outside declared capabilities
176} catch (err) {
177 await db.exec("ROLLBACK");
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 177CWE-78
▾
175 await db.exec("COMMIT");
176} catch (err) {
177 await db.exec("ROLLBACK");← spawns a subprocess outside declared capabilities
178 throw err;
179}
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 201CWE-78
▾
199const db = await connect(":memory:");
200
201await db.exec(`← spawns a subprocess outside declared capabilities
202 CREATE TABLE users (
203 id SERIAL PRIMARY KEY,
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 210CWE-78
▾
208`);
209
210await db.exec("INSERT INTO users (name, email) VALUES ('Alice', 'alice@example.com')");← spawns a subprocess outside declared capabilities
211
212const stmt = db.prepare<User>("SELECT * FROM users");
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 313CWE-78
▾
311 const db = await connect(":memory:");
312
313 await db.exec("CREATE TABLE scratch (key TEXT PRIMARY KEY, value TEXT)");← spawns a subprocess outside declared capabilities
314
315 // Agent writes intermediate results
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 316CWE-78
▾
314
315 // Agent writes intermediate results
316 await db.exec(← spawns a subprocess outside declared capabilities
317 "INSERT INTO scratch VALUES ($1, $2)",
318 [`agent-${agentId}`, sql]
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
View latest scan →
skillox.io/c/pgmicro-postgres-sqlite