supabase-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
npx supabaseCLI commands andgrepsearch patterns. These are used appropriately for project management, migration deployment, and security auditing (e.g., verifying that theservice_rolekey is not present in client-side distribution files). - [EXTERNAL_DOWNLOADS]: The skill uses
curlto fetch status information from the official Supabase status API (status.supabase.com) and to perform health checks on the user's application. These operations target trusted or user-controlled domains and do not execute remote code. - [CREDENTIALS_UNSAFE]: A database connection string flagged in
references/implementation.mdwas found to be a documentation template (using[PASSWORD]and[REF]placeholders) for teaching environment variable setup, rather than a leak of real credentials. - [DATA_EXFILTRATION]: No data exfiltration patterns were observed. The skill focuses on preventing key leakage and enforcing strict key separation between client-side and server-side environments.
Audit Metadata