supabase-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches project status information from Supabase's official status API at status.supabase.com. This is a well-known service and the operation is used to include platform health in the diagnostic bundle.
- [DYNAMIC_CONTEXT_INJECTION]: Uses dynamic context markers to verify the local environment during skill load. It checks for the presence of Node.js, the Supabase CLI, and the
@supabase/supabase-jspackage to ensure the environment is ready for diagnostics. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from platform status APIs and local log files.
- Ingestion points: Reads from
status.supabase.com,~/.npm/_logs/, and.envfiles (in reference implementations). - Boundary markers: None explicitly used for the final archive contents, but the data is collected for manual support submission.
- Capability inventory: Includes file writing (
mkdir,tar), command execution (npx supabase inspect), and network reads (curl). - Sanitization: Implements extensive redaction logic using
sedto mask JWT tokens, project keys, email addresses, and environment variable values before the data is bundled. - [COMMAND_EXECUTION]: Executes several Supabase CLI diagnostic commands such as
supabase inspect db table-sizes,index-usage, andcache-hit. These are standard tools for identifying database performance issues and are consistent with the skill's primary purpose.
Audit Metadata