supabase-multi-env-setup
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file references/implementation.md contains hardcoded JWT tokens (NEXT_PUBLIC_SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY) intended for local development. These are publicly documented static keys used by the Supabase CLI for local instances and are explicitly marked as non-sensitive defaults for documentation purposes.\n- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to run supabase and vercel CLI commands for linking projects, pushing migrations, and deploying functions. This usage is consistent with the skill's stated purpose of managing cloud database environments.\n- [INDIRECT_PROMPT_INJECTION]: The skill relies on external configuration data from .env and JSON files which are used to construct shell commands, creating a potential vector for indirect prompt injection.\n
- Ingestion points: .env files and configuration JSON files described in references/implementation.md and references/configuration-structure.md.\n
- Boundary markers: Not explicitly defined in the provided implementation templates.\n
- Capability inventory: Write file access and Bash command execution for Supabase and Vercel CLI tools.\n
- Sanitization: There is no explicit evidence of variable sanitization when interpolating environment-derived values into shell commands.
Audit Metadata