supabase-database

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill reads data from Supabase tables which could contain malicious instructions if the database is compromised or contains user-generated content.
  • Ingestion points: Data is retrieved through supabase_get calls in SKILL.md.
  • Boundary markers: No specific delimiters or instructions are provided to the agent to treat external database content as untrusted.
  • Capability inventory: The skill uses curl for network access and shell utilities like jq, grep, and date for data processing.
  • Sanitization: The provided templates do not demonstrate validation or escaping of the data fetched from the API before it is processed by other tools.
  • [COMMAND_EXECUTION]: The skill uses shell commands including jq for parsing JSON responses and grep to inspect HTTP headers.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations against supabase.co domains, which is a well-known database service.
  • [DYNAMIC_EXECUTION]: The skill uses the source command to dynamically load a helper script located at a relative path ../../scripts/supabase-api.sh.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 09:43 AM