skills/jeremylongshore/tons-of-skills-marketplace/supabase-auth-storage-realtime-core/Gen Agent Trust Hub
supabase-auth-storage-realtime-core
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official libraries from well-known package registries to interact with Supabase services. \n
- Mentions
npm install @supabase/supabase-jsfor JavaScript/TypeScript development. \n - Mentions
pip install supabasefor Python development. \n- [INDIRECT_PROMPT_INJECTION]: The skill instructions and provided code examples establish a vulnerability surface by processing untrusted data from external sources. \n - Ingestion points: Untrusted data enters the agent's environment through Postgres change subscriptions in
references/realtime.md, file downloads inreferences/storage.md, and real-time broadcast/presence events. \n - Boundary markers: Example implementation code and instructions do not specify the use of delimiters or 'ignore' instructions when handling data retrieved from the database or storage buckets. \n
- Capability inventory: The skill environment permits the agent to execute shell commands via
Bash(npm:*)andBash(supabase:*), and modify the filesystem usingWriteandEdittools. \n - Sanitization: No validation or sanitization logic is included in the reference examples for data fetched from external Supabase tables or files.
Audit Metadata