pgvector-similarity-search

Warn

Audited by Socket on Feb 27, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

This skill is coherent with its stated purpose: performing semantic similarity search using pgvector and an external embedding service. The implementation uses parameterized queries and a stored SQL function, which reduces injection risk. The main security consideration is data sent to the embedding service (OllamaClient): embeddings and original text are transmitted to an external endpoint, which is expected functionality but a privacy and trust boundary. There are no download-execute chains, no hidden backdoors, and no direct credential-harvesting code in the fragment provided. Recommended precautions: ensure OllamaClient is configured to use a trusted endpoint, review its transport security and logging policies, restrict and rotate PostgreSQL and Ollama credentials appropriately, and avoid sending highly sensitive plaintext to external embedding services.

Confidence: 75%Severity: 75%
Audit Metadata
Analyzed At
Feb 27, 2026, 05:34 AM
Package URL
pkg:socket/skills-sh/constructive-io%2Fconstructive-skills%2Fpgvector-similarity-search%2F@78439c790b2fc6721a8afe84e39fd39a711d984d