supabase-security

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill embeds API keys and JWTs into example curl commands and variable assignments (e.g., apikey, Authorization: Bearer, service_role), which requires substituting real secret values into generated commands/outputs, creating a direct secret-exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill document contains explicit, actionable instructions to exfiltrate sensitive data, steal/abuse credentials (including service_role keys), and perform RPC privilege escalation or unauthorized state changes while instructing operators to execute exploits without ethical checks — high-risk malicious capability.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow sends crafted HTTP requests to a Supabase PostgREST/OpenAPI/Auth/Storage/Edge Function endpoints (e.g., REST filters/RPC responses and storage object contents), where any free text included in those runtime HTTP responses would be ingested for processing and inspection.