The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The file cookbook/rls-policies.md provides code examples for 'Security Functions' (is_admin at lines 152-161 and get_user_team_ids at lines 172-180) using the SECURITY DEFINER attribute without pinning the search_path. This implementation allows the function to execute with the privileges of the creator rather than the caller. Without a fixed search_path, an attacker with schema creation permissions could create malicious objects (like a table or function with the same name as those used in the function) to intercept execution and elevate privileges.
[INDIRECT_PROMPT_INJECTION]: The skill instructions and cookbooks guide the agent in defining database schemas and Row Level Security (RLS) policies based on user input. This creates an indirect injection surface where malicious data ingested from external sources could influence the generated security policies or schema structure.
Ingestion points: SQL schema definitions, user role requirements, and data access rules processed in SKILL.md and referenced cookbooks.
Boundary markers: The skill includes a 'Red Flags
STOP and Reconsider' section to warn against unsafe practices, but lacks formal delimiters for external data input.
Capability inventory: Subprocess execution via supabase CLI, file write operations for migrations and types, and database schema modification.
Sanitization: No explicit sanitization or validation of the input data structure is described.
[COMMAND_EXECUTION]: The SKILL.md file contains instructions for executing several supabase CLI commands (e.g., supabase init, supabase start, supabase db push). While these are standard tools for Supabase development, they involve the execution of external binaries with access to the local environment and database configuration.
[CREDENTIALS_UNSAFE]: The code snippets in SKILL.md reference the retrieval of SUPABASE_URL and SUPABASE_ANON_KEY from environment variables (process.env). While documented as standard placeholders, they involve the handling of project credentials which, if mismanaged (e.g., using a service-role key instead of an anon key), could lead to unauthorized data access.

supabase-patterns