supabase-automation
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted database content, creating a surface for indirect instructions to influence agent behavior.
- Ingestion points: The agent fetches potentially attacker-controlled data using tools like
SUPABASE_SELECT_FROM_TABLEandSUPABASE_LIST_TABLES(SKILL.md). - Boundary markers: No instructions are provided for using delimiters or boundary markers to isolate external data from the system prompt.
- Capability inventory: The skill enables high-privilege operations such as arbitrary SQL execution and retrieval of service-role API keys.
- Sanitization: There is no guidance on sanitizing or validating data retrieved from the database before it is used in subsequent reasoning steps.
- [COMMAND_EXECUTION]: The
SUPABASE_BETA_RUN_SQL_QUERYtool allows the execution of arbitrary PostgreSQL statements, posing a risk of unauthorized database modification. - [CREDENTIALS_UNSAFE]: The
SUPABASE_GET_PROJECT_API_KEYStool provides access to sensitive service-role keys from the project environment. - [EXTERNAL_DOWNLOADS]: The skill configuration requires connecting to a third-party managed MCP server at
https://rube.app/mcp.
Audit Metadata