·
Last changedVersion:
This version passed the hardening gate. The skill content was retained without changes. Classified findings before hardening: 23. Classified findings closed: 0. Classified findings remaining: 23. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 8.
5
18
5
18
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/query-patterns.md | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
references/schema-design.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Open | |
references/indexing.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Open | |
references/monitoring.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Open | |
SKILL.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Open | |
references/architecture.md | Prompt Injection | Third-party content as instructions | Low | Open | |
references/schema-changes.md | Prompt Injection | Third-party content as instructions | Low | Open | |
references/cli-and-insights.md | Prompt Injection | Third-party content as instructions | Low | Open |
23 findings
Docs: https://planetscale.com/docs/neki · https://neki.dev/
Neki is distributed (sharded) Postgres by PlanetScale. Every shard is real Postgres; Neki places a router in front of the shards and adds per-instance sidecars and a control plane (topology service, admin, Replicator) to route, coordinate, and operate Postgres across many shards — all behind one Postgres connection string on port 5432. Applications use standard Postgres clients, drivers, and ORMs.
Neki is built by the maintainers of Vitess but is a from-scratch system for Postgres, not a Vitess port. It has been demonstrated at about 100 million queries per second and more than a petabyte, and also suits small, unsharded databases (which still get online DDL, zero-downtime operations, connection pooling, and online version upgrades). A new database starts unsharded and can be sharded later.
Per-shard Postgres (VACUUM, WAL, memory, storage, index audits) is ordinary Postgres. Use the postgres skill. On Neki, a configuration profile's Postgres parameters apply to every shard on that profile, and VACUUM, ANALYZE, and VACUUM FULL sent through a router run on every shard even when __neki.shard is set.
5432 with sslmode=verify-full — there is no separate pooler port (no 6432/PgBouncer); pooling happens inside Neki.xxhash, modulo, range) that decides where rows live and how queries route.__neki.target, __neki.fanout, __neki.tx_mode, __neki.shard, and __neki.replica_recency / _locality / _affinity are the only __neki.* settings; set them before BEGIN. Any other __neki.* name (a typo like __neki.transaction_mode, or an invented one) is accepted silently as a custom parameter — SET and even SHOW succeed — but does nothing. Confirm with SHOW on the real name.| Topic | Reference | Use for |
|---|---|---|
Architecture | Router, sidecar, PostgresManager, admin, Replicator, topology service, HA, query lifecycle | |
Data Topology & Sharding Model | Shard groups, shard indexes, key ranges, authoritative shard group, co-location, editing the topology | |
Sharding Readiness & Best Practices | When to shard, choosing a shard key, readiness checklist | |
Scaling & Capacity | Shard layout, hot shards and skew, shard groups, cluster sizing, workload isolation |
| Topic | Reference | Use for |
|---|---|---|
Query Planning & Routing |
| |
Transactions | Single- vs cross-shard transactions, snapshots, | |
SQL Query Patterns | Anti-patterns, pagination, N+1, Platform Preview query-shape limits | |
ID Generation | Sequences across shards, UUIDv7, composite keys | |
Error Codes | Reading |
| Topic | Reference | Use for |
|---|---|---|
Schema Design | Primary keys, data types, foreign keys, uniqueness, partitioning, unsupported objects | |
Indexing, Reference Tables & GSIs | Per-shard indexes, reference tables, global secondary indexes |
| Topic | Reference | Use for |
|---|---|---|
Schema Changes | Native DDL, managed Online and Direct DDL workflows | |
Data Migration & Resharding | MoveTables, Reshard, differ, cutover, imports | |
Replication & HA | Per-shard physical replication, failover, switchover, replica reads and lag | |
Connections | Router connections, roles, router groups, TLS, replica routing | |
Backup & Recovery | Scheduled and manual backups, restore to a new branch, PITR | |
Monitoring | Metrics, logs, Query Insights, anomalies, schema recommendations | |
Extensions | Enabling and installing extensions, pgvector on sharded tables | |
CLI, Metafunctions & Insights |
|
Get started with chainctlchainctl skill install public/planetscale/neki:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/planetscale/skills/neki:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/architecture.md
references/backup-recovery.md
references/cli-and-insights.md
references/connections.md
references/error-codes.md
references/extensions.md
references/id-generation.md
references/indexing.md
references/monitoring.md
references/query-patterns.md
references/query-serving.md
references/replication.md
references/resharding-migration.md
references/scaling-and-capacity.md
references/schema-changes.md
references/schema-design.md
references/sharding-model.md
references/sharding-readiness.md
references/transactions.md