Supabase CLI
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the
supabasepackage from the npm registry using thenpxcommand. This is used to install and run the official CLI tool provided by the vendor. - [COMMAND_EXECUTION]: Executes various shell commands via the Supabase CLI, including project initialization, starting local development stacks, running database migrations, and deploying edge functions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as database schemas and project files, which creates a surface for instructions embedded in those files to influence agent behavior.
- Ingestion points: Local project files and Postgres schemas processed by
supabase db diffandsupabase gen types(SKILL.md). - Boundary markers: None identified to separate data from instructions within the CLI output processed by the agent.
- Capability inventory: Shell command execution via
npx(SKILL.md). - Sanitization: No explicit sanitization or validation of the schema content or project files is described.
Audit Metadata