Query PostgreSQL ({{ProductName}})
Run a read-only SQL query against your PostgreSQL connection to get actual data during an
investigation. Wraps psql for read-only queries against Postgres.
⚠ Connection details are PLACEHOLDERS. No database is provisioned yet. Fill these in once the Postgres instance exists; until then, treat this skill as the agreed shape and ask Dan for connection specifics. Secrets (host/user/password) come from env / a vault — never hardcode or commit them.
Environment configuration (PLACEHOLDER — fill at provisioning)
| Environment | Host | Database | Auth |
|---|---|---|---|
| prod | <PG_HOST_PROD> |
<DB_PROD> |
<user via env/vault — read-only role> |
| test | <PG_HOST_TEST> |
<DB_TEST> |
<user via env/vault> |
| local | localhost |
<db> |
local dev creds |
Default environment if unspecified: prod (read-only).
Connection command (PLACEHOLDER)
# Prefer a connection URI from an env var; use a READ-ONLY role for investigation.
psql "$PG_URL_<ENV>" -v -P pager=off -c "<SQL_QUERY>"
# e.g. PG_URL_PROD="postgresql://<readonly_user>@<host>:5432/<db>?sslmode=require"
Discipline
- Read-only only —
SELECT/EXPLAIN. Anything destructive (DROP/TRUNCATE/unqualifiedDELETE/UPDATE) is blocked/prompted by theprotect-commandshook and is never part of an investigation. - All times UTC. Use
timestamptz; displayAT TIME ZONE 'UTC'. - Discover tenants dynamically — never hardcode tenant ids/names. (Tenant-discovery query depends on the
final schema — PLACEHOLDER, e.g.
SELECT id, name FROM tenants ORDER BY name;.) - Never select or print secrets/PII beyond what the investigation needs; respect EU residency.
- Parameterize where the harness allows; never build SQL by string-concatenating untrusted input.
Steps
- Pick the environment (
$0, defaultprod). - Run the query via
psqlwith the read-only connection. - Present results cleanly; cite them as evidence in the diagnosis.