Why this verdict
- inconclusive: gap external_plugin_source at .claude-plugin/marketplace.json
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the coverage gaps below; 2 candidate findings were refuted on review.
Execution chain 9
What it calls, runs, installs, reads and writes, with the line that does it.
URLs 5
https://github.com/jeffallan
https://github.com/Jeffallan
https://jeffallan.github.io/claude-skills/skills/infrastructure/postgres-pro/
https://synergetic.solutions
https://synergetic.solutions
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Destructive action
criticalRefutedlow confidenceThe standby setup documentation instructs running rm -rf against the PostgreSQL data directory before pg_basebackup, which irreversibly deletes all database files at that path if executed on the wrong host or without the intended rebuild context.
rm -rf /var/lib/postgresql/14/main/*
Why it was refuted
The rm -rf is an openly commented, service-stopped, immediately repopulated step in the standard standby-seeding procedure (stop postgresql, wipe data dir, pg_basebackup rebuilds it), squarely inside the skill's declared core capability of 'configuring replication'; the claimed harm (wrong host, no rebuild context) is speculative user misuse, not behavior the artifact instructs, so the declared-core-capability carve-out defeats the harm gate and nothing is concealed or contradicts a declaration.
Destructive action
criticalRefutedlow confidenceThe point-in-time recovery documentation instructs running rm -rf against the live PostgreSQL data directory before restoring a base backup, which irreversibly deletes all database files at that path if the backup is absent, corrupted, or the wrong host is targeted.
rm -rf /var/lib/postgresql/14/main/*
Why it was refuted
The rm -rf is an openly documented, service-stopped step of standard point-in-time recovery, instantly followed by extracting the base backup into the same directory, serving the skill's declared scope of implementing advanced database features; the asserted risk (backup absent, corrupted, wrong host) is hypothetical misuse of an otherwise canonical recovery procedure, so the declared-core-capability carve-out defeats the harm gate and the step is neither concealed nor contradicting any declaration.
Coverage gaps 1
Parts of the artifact the static analysis could not fully examine.
external_plugin_source plugin 'fullstack-dev-skills' source is not local
.claude-plugin/marketplace.json
