supabase-debug-bundle

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches platform health data from the official Supabase status page. This is a reference to a well-known service and is used solely for diagnostic reporting.
  • [COMMAND_EXECUTION]: Utilizes standard system utilities (node, npx, curl, tar, sed) and the Supabase CLI to inspect project status and database performance. These operations are consistent with the skill's stated purpose of gathering technical support information.
  • [CREDENTIALS_UNSAFE]: The skill interacts with sensitive environment variables (SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY) and reads the local .env file. However, it incorporates a robust redaction step using regex-based sed commands to mask secrets and PII before any data is archived or shared.
  • [REMOTE_CODE_EXECUTION]: An automated scanner flagged a pipe to python3 via curl. Detailed inspection confirms this is a false positive; the command uses python3 -m json.tool, which is a standard library module used for pretty-printing JSON data, not for executing arbitrary code.
  • [DYNAMIC_CONTEXT_INJECTION]: Employs dynamic context placeholders (!command) to verify the local environment (Node.js and CLI versions) upon skill loading. These are benign checks required for the skill to function correctly.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 01:19 AM
Security Audit — agent-trust-hub — supabase-debug-bundle