supabase-security-basics
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [SAFE]: The skill provides defensive security instructions for Supabase projects, emphasizing the mandatory use of Row Level Security (RLS) and the critical distinction between public (anon) and private (service_role) API keys.
- [EXTERNAL_DOWNLOADS]: The skill references the official @supabase/supabase-js library and uses the official supabase CLI via npx, both of which are trusted and well-known services within the developer ecosystem.
- [DATA_EXFILTRATION]: Network operations are restricted to legitimate health checks targeting official vendor domains (api.supabase.com), representing standard development practices.
- [CREDENTIALS_UNSAFE]: The skill demonstrates secure handling of credentials by using placeholders (e.g., sk_live_***) in examples and correctly advising users to manage secrets via .env files included in .gitignore.
Audit Metadata