golang-gin-psql-dba — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited golang-gin-psql-dba (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Make PostgreSQL architecture decisions for Go Gin APIs. Schema design, migration safety, index strategy, query optimization, and extension selection. Uses raw SQL via sqlx — for ORM patterns, see the golang-gin-database skill.
golang-gin-psql-dba vs golang-gin-database: This skill covers PostgreSQL decisions (schema, indexes, perf). golang-gin-database covers code (GORM/sqlx wiring, repository pattern, migrations tooling).
| Rule | Do | Don't |
|---|---|---|
| Primary keys | UUID DEFAULT gen_random_uuid() or BIGINT GENERATED ALWAYS AS IDENTITY | SERIAL (legacy) |
| Timestamps | TIMESTAMPTZ with DEFAULT now() | TIMESTAMP (no timezone) |
| Booleans | NOT NULL DEFAULT false | Nullable booleans |
| Money | NUMERIC(19,4) | FLOAT, REAL |
| Status/enum | TEXT + CHECK, or PostgreSQL ENUM | Free-text strings |
| Naming | snake_case, plural tables, singular columns | camelCase |
| Foreign keys | Always ON DELETE clause | Omitting ON DELETE |
For complete patterns (normalization, multi-tenancy, audit trails): see references/schema-design-naming-and-types.md.
| Query Pattern | Index Type | When |
|---|---|---|
| Equality, range | B-tree (default) | Most queries |
| Full-text search, JSONB, arrays | GIN | @@, @>, && operators |
| Geometric / spatial / range | GiST | PostGIS, range types |
| Large table, monotonic column | BRIN | Time-series, append-only |
| Trigram similarity | GIN + pg_trgm | LIKE '%foo%' |
| Vector embeddings | HNSW / IVFFlat | pgvector similarity |
Default to B-tree. Switch only when B-tree cannot serve the query. For deep dive with EXPLAIN ANALYZE: see references/index-strategy-types-and-variants.md.
| Need | Extension | Reference |
|---|---|---|
| Full-text BM25 search | ParadeDB | paradedb-setup-and-basic-search.md |
| Vector similarity | pgvector | pgvector-setup-and-schema.md |
| Geospatial queries | PostGIS | postgis-setup-types-and-indexes.md |
| Time-series data | TimescaleDB | timescaledb-setup-and-hypertables.md |
| Cron jobs in PostgreSQL | pg_cron | extensions-toolkit-setup-and-cron.md |
| Partition management | pg_partman | extensions-toolkit-partman-and-trgm.md |
| Fuzzy string matching | pg_trgm | extensions-toolkit-partman-and-trgm.md |
For migration safety (lock levels, zero-downtime ALTER TABLE): see references/migration-impact-locks-and-operations.md. For query tuning (pg_stat_statements, autovacuum, pool sizing): see references/query-performance-stats-and-vacuum.md.
lock_timeout in migrations — never risk blocking all trafficThis skill handles PostgreSQL architecture decisions: schema design, index strategy, migration safety, query optimization, partitioning, extensions. Does NOT handle ORM/driver code (see golang-gin-database), application-level auth (see golang-gin-auth), or deployment (see golang-gin-deploy).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.