supabase
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: All network communications are directed to the official and well-known Supabase Management API endpoint (api.supabase.com).
- [SAFE]: The skill manages the Supabase access token by storing it in a dedicated configuration directory (
~/.config/supabase/token) with restricted file permissions (0600), which is a standard security best practice for local development tools. - [SAFE]: Implementation is strictly limited to the Ruby standard library (net/http, json, uri, fileutils), effectively mitigating supply chain risks associated with third-party gems or external packages.
- [DATA_EXPOSURE]: The skill retrieves sensitive information such as project API keys and lists environment secrets. While secrets are partially masked in the output, the full API keys are displayed to the agent as part of the management functionality. This is consistent with the skill's primary purpose but requires user awareness.
Audit Metadata