supabase-prod-checklist

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes npx supabase CLI commands and grep search patterns. These are used appropriately for project management, migration deployment, and security auditing (e.g., verifying that the service_role key is not present in client-side distribution files).
  • [EXTERNAL_DOWNLOADS]: The skill uses curl to fetch status information from the official Supabase status API (status.supabase.com) and to perform health checks on the user's application. These operations target trusted or user-controlled domains and do not execute remote code.
  • [CREDENTIALS_UNSAFE]: A database connection string flagged in references/implementation.md was found to be a documentation template (using [PASSWORD] and [REF] placeholders) for teaching environment variable setup, rather than a leak of real credentials.
  • [DATA_EXFILTRATION]: No data exfiltration patterns were observed. The skill focuses on preventing key leakage and enforcing strict key separation between client-side and server-side environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:47 AM