supabase-debug-bundle

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches project status information from Supabase's official status API at status.supabase.com. This is a well-known service and the operation is used to include platform health in the diagnostic bundle.
  • [DYNAMIC_CONTEXT_INJECTION]: Uses dynamic context markers to verify the local environment during skill load. It checks for the presence of Node.js, the Supabase CLI, and the @supabase/supabase-js package to ensure the environment is ready for diagnostics.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from platform status APIs and local log files.
  • Ingestion points: Reads from status.supabase.com, ~/.npm/_logs/, and .env files (in reference implementations).
  • Boundary markers: None explicitly used for the final archive contents, but the data is collected for manual support submission.
  • Capability inventory: Includes file writing (mkdir, tar), command execution (npx supabase inspect), and network reads (curl).
  • Sanitization: Implements extensive redaction logic using sed to mask JWT tokens, project keys, email addresses, and environment variable values before the data is bundled.
  • [COMMAND_EXECUTION]: Executes several Supabase CLI diagnostic commands such as supabase inspect db table-sizes, index-usage, and cache-hit. These are standard tools for identifying database performance issues and are consistent with the skill's primary purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:48 AM