The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill includes hardcoded JWT strings for local testing in reference files.
Evidence: Found in references/ci-workflows.md for SUPABASE_ANON_KEY and SUPABASE_SERVICE_ROLE_KEY.
Context: These are documented as default local development keys for testing against a local Supabase instance and contain a demo issuer.
[EXTERNAL_DOWNLOADS]: The skill references the official Supabase setup action for GitHub Actions.
Source: supabase/setup-cli@v1 referenced in SKILL.md and references/ci-workflows.md.
[COMMAND_EXECUTION]: The skill provides instructions to perform administrative tasks using the GitHub CLI and Supabase CLI.
Evidence: Instructions for gh secret set and npx supabase commands found throughout the documentation.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes various project files, creating a potential vulnerability to embedded malicious instructions.
Ingestion points: Reads SQL migrations (supabase/migrations/**), functions (supabase/functions/**), and workflow configurations.
Capability inventory: The skill utilizes Write and Bash tools to modify project files and interact with repository secrets.
Boundary markers: No specific delimiters or safety instructions are provided in the templates to isolate potentially untrusted file content.
Sanitization: No explicit validation or filtering is performed on the ingested code or configuration files.

supabase-ci-integration