supabase-debug-bundle
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches platform health data from the official Supabase status page. This is a reference to a well-known service and is used solely for diagnostic reporting.
- [COMMAND_EXECUTION]: Utilizes standard system utilities (node, npx, curl, tar, sed) and the Supabase CLI to inspect project status and database performance. These operations are consistent with the skill's stated purpose of gathering technical support information.
- [CREDENTIALS_UNSAFE]: The skill interacts with sensitive environment variables (SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY) and reads the local
.envfile. However, it incorporates a robust redaction step using regex-basedsedcommands to mask secrets and PII before any data is archived or shared. - [REMOTE_CODE_EXECUTION]: An automated scanner flagged a pipe to
python3via curl. Detailed inspection confirms this is a false positive; the command usespython3 -m json.tool, which is a standard library module used for pretty-printing JSON data, not for executing arbitrary code. - [DYNAMIC_CONTEXT_INJECTION]: Employs dynamic context placeholders (
!command) to verify the local environment (Node.js and CLI versions) upon skill loading. These are benign checks required for the skill to function correctly.
Audit Metadata