Agent skill · Audited from source

pg-aiguide

skill · timescale/pg-aiguideApache-2.0 licenceAudited 23 Oct 2026 · source c8ed45084a23

★ 1,873pushed 1 day ago
!CAUTIONGrade B · 85/100 · 12 findings · c8ed450
1,873repo stars · whole timescale/pg-aiguide

Is it safe? With care — CAUTION, grade B (85/100). We read this skill's source at commit c8ed45084a23 and observed filesystem, network and shell access and a hard-coded secret (see the findings). The audit raised 12 findings, 1 critical or high. What it does: Comprehensive PostGIS spatial table design reference covering geometry types, coordinate systems, spatial indexing, and performance patterns for location-based applications

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “pg-aiguide (timescale/pg-aiguide)”. Retrieved 23 Oct 2026. https://modelsatlas.com/skills/timescale/pg-aiguide

Trust audit

Audit 0.4.1 · source read 23 Oct 2026

Trust score85/100!CAUTION B
0 critical1 high0 medium10 low1 info

CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemDeclared4 observations
  • NetworkDeclared4 observations
  • ShellDeclared5 observations
  • DependenciesNot pinnedSome versions float
  • SecretsFoundSee the findings; values are never shown

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS6
L1 Static sourceSecrets, path traversal, supply chain, hidden codeFAIL4
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS2
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (12)

HIGHHard-coded secretssecret.db_uri · ingest/utils/db.py:18
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
return f"…"
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .env.sample
F-13 Inventory / provenanceCWE-1104Layer L0
.env.sample
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInsecure cryptocrypto.weak_hash · ingest/tiger_docs.py:1055
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
hash_suffix = hashlib.md5(path.encode()).hexdigest()[:8]
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/prompts/index.ts:10
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
new URL('../../skills/', import.meta.url), // src/prompts/index.ts -> skills (checkout/Docker)
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@openrouter/ai-sdk-provider, @opentelemetry/api, dotenv, gray-matter, migrate, pg, zod, @biomejs/biome
Why
15 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWPrompt injectionprompt.transfer_instruction · skills/schema-exploration/references/foreign-tables.md:7
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
`$1` = schema name, `$2` = foreign table name. Server/table options are listed by **name only**: option values and user mappings may contain connection details or credentials. Don't collect or report
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
INFOPrompt injectionprompt.authority_framing · README.md:262
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
> You are a senior software engineer. You are given a task to generate a Postgres schema for an IoT device company.
Why
No further detail recorded for this rule.
Fix
—

Audit 0.4.1 · source sha c8ed45084a23 · 23 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publishertimescale GitHub organizationOwner of the repository this skill is read from
  • Source foldertimescale/pg-aiguideThe exact folder we audited
  • LicenceApache-2.0As the repository states it
  • Commit pinned for this verdictc8ed45084a23A new audit runs when the source changes
  • Repository statusNot archivedLast push 1 day ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Comprehensive PostGIS spatial table design reference covering geometry types, coordinate systems, spatial indexing, and performance patterns for location-based applications

---
name: design-postgis-tables
description: Comprehensive PostGIS spatial table design reference covering geometry types, coordinate systems, spatial indexing, and performance patterns for location-based applications
license: Apache-2.0
compatibility: Requires PostgreSQL 15+ with the PostGIS extension
metadata:
  author: tigerdata
---

# PostGIS Spatial Table Design

## Before You Start (5 Questions)

1. What is the geographic scope (single city/region vs global)?
2. What are your primary query patterns (within-radius, bbox, intersects, nearest-neighbor)?
3. What units do you need for distance/area (meters vs CRS units), and how accurate must they be?
4. What is the expected scale (rows, write rate), and is the data mostly append-only?
5. Do you need 3D (Z) or measures (M), or is 2D enough?

**SQL injection note:** When turning these patterns into application code, use parameterized queries for user-provided values (WKT/WKB, coordinates, IDs, radii). Avoid string-concatenating untrusted input into SQL; for dynamic identifiers, use safe identifier quoting/whitelisting.

## Core Rules

- **Always use PostGIS geometry/geography types** instead of PostgreSQL's built-in geometric types (`POINT`, `LINE`, `POLYGON`, `CIRCLE`). PostGIS types provide true spatial capabilities.
- **Choose between GEOMETRY and GEOGRAPHY** based on your use case: GEOMETRY for projected/local data with Cartesian math; GEOGRAPHY for global data requiring accurate spherical calculations.
- **Always specify SRID** (Spatial Reference Identifier) when creating geometry columns. Use `4326` (WGS84) for GPS/global data, appropriate local projections for regional data.
- **Create spatial indexes** on all geometry/geography columns using GiST (default). Consider BRIN only for very large **GEOMETRY** tables where rows are naturally ordered on disk and you can tolerate coarser filtering.
- **Use constraint-based type enforcement** with `GEOMETRY(type, SRID)` syntax to ensure data integrity.

## Geometry vs Geography

### When to Use GEOMETRY

- **Local/regional data** within a single coordinate system
- **Projected coordinates** (meters, feet) for accurate area/distance calculations
- **Complex spatial operations** (buffering, unions, intersections)
- **Performance-critical queries** (Cartesian math is faster)
- **Data already in a projected CRS** (UTM, State Plane, etc.)

```sql
-- Regional data with projected coordinates (UTM Zone 10N for California)
CREATE TABLE local_parcels (
    id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
    parcel_number TEXT NOT NULL,
    boundary GEOMETRY(POLYGON, 26910),  -- UTM Zone 10N (meters)
    area_sqm DOUBLE PRECISION GENERATED ALWAYS AS (ST_Area(boundary)) STORED
);
```

### When to Use GEOGRAPHY

- **Global data** spanning multiple continents/hemispheres
- **GPS coordinates** (latitude/longitude in decimal degrees)
- **Accurate distance calculations** on Earth's surface (great circle)
- **Simple spatial operations** (distance, containment)
- **Data from GPS devices, geocoding services, or web maps**

```sql
-- Global data with geodetic calculations
CREATE TABLE global_offices (
    id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
    name TEXT NOT NULL,
    city TEXT NOT NULL,
    location GEOGRAPHY(POINT, 4326)  -- WGS84 (lat/lon)
);

-- Distance in meters (accurate spherical calculation)
SELECT
    a.name AS office_a,
    b.name AS office_b,
    ST_Distance(a.location, b.location) / 1000 AS distance_km
FROM global_offices a
CROSS JOIN global_offices b
WHERE a.id < b.id;
```

### Comparison Table

| Aspect            | GEOMETRY                              | GEOGRAPHY                 |
| ----------------- | ------------------------------------- | ------------------------- |
| Coordinate system | Any SRID (projected or geodetic)      | WGS84 (SRID 4326) only    |
| Distance units    | CRS units (degrees, meters, feet)     | Meters (always)           |
| Distance accuracy | Depends on projection                 | True spheroidal distance  |
| Area accuracy     | Accurate in projected CRS             | Accurate on sphere        |
| Function support  | Full (300+ functions)                 | Limited (~40 functions)   |
| Performance       | Faster (Cartesian math)               | Slower (spherical math)   |
| Index type        | GiST, BRIN, SP-GiST                   | GiST only                 |
| Best for          | Regional/local data, complex analysis | Global data, GPS tracking |

## Geometry Types

### Point Types

```sql
-- Single location (stores, sensors, events)
location GEOMETRY(POINT, 4326)

-- Multiple discrete locations (multi-branch business)
locations GEOMETRY(MULTIPOINT, 4326)

-- 3D point with elevation
location_3d GEOMETRY(POINTZ, 4326)

-- Point with measure value (linear referencing)
location_m GEOMETRY(POINTM, 4326)
```

**Use POINT for:** Store locations, sensor positions, event coordinates, addresses, POIs
**Use MULTIPOINT for:** Multiple related locations stored as single feature

### Line Types

```sql
-- Single path (road segment, river, route)
path GEOMETRY(LINESTRING, 4326)

-- Multiple paths (road network, transit lines)
network GEOMETRY(MULTILINESTRING, 4326)

-- 3D line with elevation profile
trail_3d GEOMETRY(LINESTRINGZ, 4326)
```

**Use LINESTRING for:** Roads, rivers, pipelines, GPS tracks, routes
**Use MULTILINESTRING for:** Disconnected road segments, river systems

### Polygon Types

```sql
-- Single area (parcel, building footprint, zone)
boundary GEOMETRY(POLYGON, 4326)

-- Multiple areas (archipelago, fragmented habitat)
territories GEOMETRY(MULTIPOLYGON, 4326)

-- 3D polygon (building with height)
footprint_3d GEOMETRY(POLYGONZ, 4326)
```

**Use POLYGON for:** Property boundaries, administrative areas, service zones
**Use MULTIPOLYGON for:** Countries with islands, fragmented regions

### Generic Types

```sql
-- Any geometry type (flexible schema)
geom GEOMETRY(GEOMETRY, 4326)

-- Collection of mixed types
features GEOMETRY(GEOMETRYCOLLECTI

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit c8ed450

Download folder ↗
git clone [email protected]:timescale/pg-aiguide.git
npx skills add timescale/pg-aiguide --skill postgres
npx skills add timescale/pg-aiguide --skill schema-exploration
npx skills add timescale/pg-aiguide
claude plugin install pg@aiguide

Commands as the repository documents them: shown, never run by us. Our verdict covers commit c8ed45084a23 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
Claude DesktopMentioned in its text, not testedSkills for Claude Desktop · About Claude Desktop
CodexMentioned in its text, not testedSkills for Codex · About Codex
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
Gemini CLIMentioned in its text, not testedSkills for Gemini CLI · About Gemini CLI
WindsurfMentioned in its text, not testedSkills for Windsurf · About Windsurf
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. !CAUTION B 85 / 100

    first audit · source c8ed45084a23

README badge

For maintainers · shows the latest audit

ModelsAtlas: CAUTION BMODELSATLASCAUTION · B
[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/timescale/pg-aiguide/badge.svg)](https://modelsatlas.com/skills/timescale/pg-aiguide/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Add this badge to your README

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/timescale/pg-aiguide/badge.svg)](https://modelsatlas.com/skills/timescale/pg-aiguide/)

Questions about pg-aiguide

What does the pg-aiguide skill do?
MCP server and Claude plugin for Postgres skills and documentation. Helps AI coding tools generate better PostgreSQL code.
Is pg-aiguide safe to install?
With care. The audit graded it B (85/100) and found 12 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can pg-aiguide access on my machine?
The audit observed that it reaches the network, runs shell commands and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: found — see the findings.
Which assistants does pg-aiguide work with?
Its documentation mentions claude-code, claude-desktop, codex, cursor, gemini-cli and windsurf. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (c8ed45084a23), read on 2026-10-23. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.