supabase-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with Supabase database schema and metadata to perform security audits.
- Ingestion points: Processes database table names, schema structure, and RLS policy definitions via SQL queries described in
SKILL.md. - Boundary markers: The skill relies on standard SQL syntax and Supabase CLI tool outputs.
- Capability inventory: Utilizes Bash tools scoped to
supabase:*andnpx supabase:*for project management, alongside standard file Read/Write/Edit/Grep operations. - Sanitization: The instructions explicitly warn against SQL injection and direct the user to employ parameterized SDK methods rather than raw string interpolation.
- [EXTERNAL_DOWNLOADS]: The skill references the
@supabase/supabase-jspackage for installation via npm. This is the official, well-known library for interacting with Supabase services. - [CREDENTIALS_UNSAFE]: The documentation and code examples discuss the handling of sensitive API keys and configuration files. It correctly identifies the
service_rolekey as a high-privilege credential that must remain server-side and provides instructions for securing environment variables using.gitignore. All examples use non-functional placeholders like***or generic strings.
Audit Metadata