api-baas-supabase
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE]: The skill strongly emphasizes the use of environment variables for API keys and project URLs. It includes explicit warnings and 'Bad Examples' demonstrating the risks of hardcoding secrets or exposing the service_role (secret) key in client-side code.
- [PROMPT_INJECTION]: No evidence of instructions designed to override agent behavior or bypass safety guardrails was detected.
- [REMOTE_CODE_EXECUTION]: The skill uses standard package managers (npm) and official Supabase libraries. There are no suspicious remote script executions or unverified downloads.
- [DATA_EXFILTRATION]: No unauthorized data transmission or access to sensitive local file paths (e.g., .ssh, .aws) was observed. The network operations are restricted to standard Supabase API interactions.
- [INDIRECT_PROMPT_INJECTION]: While the skill involves ingesting data from external sources (Supabase database), it provides robust guidance on using Row Level Security (RLS) to ensure data isolation and prevent unauthorized access or manipulation at the database layer.
- [OBFUSCATION]: The content is clear and readable. A Base64-encoded string found in a documentation example was verified as a non-malicious JWT header snippet used for educational purposes.
- [DYNAMIC_CONTEXT_INJECTION]: No use of shell command execution placeholders in metadata or instructions was found.
Audit Metadata