The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from database tables without adequate protection.
Ingestion points: Data from the database enters the context via SUPABASE_SELECT_FROM_TABLE and SUPABASE_LIST_TABLES in SKILL.md.
Boundary markers: Absent. There are no instructions to use delimiters or ignore commands found within the retrieved data.
Capability inventory: The agent can execute arbitrary SQL via SUPABASE_BETA_RUN_SQL_QUERY and retrieve sensitive secrets via SUPABASE_GET_PROJECT_API_KEYS in SKILL.md.
Sanitization: Absent. No filtering or validation of database content is mentioned before the agent acts upon it.
[DATA_EXFILTRATION]: The SUPABASE_GET_PROJECT_API_KEYS tool retrieves live service-role keys. While the documentation contains a warning to handle them carefully and mask values, the capability itself presents a risk of credential exposure if the agent is manipulated.
[COMMAND_EXECUTION]: The tool SUPABASE_BETA_RUN_SQL_QUERY allows for arbitrary SQL execution on the connected project. This provides a direct path for data modification or deletion if the agent's instructions are overridden.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to configure an external MCP server at https://rube.app/mcp. This creates a runtime dependency on an external endpoint for retrieving tool schemas and managing connections.

supabase-automation