supabase-database
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads data from Supabase tables which could contain malicious instructions if the database is compromised or contains user-generated content.
- Ingestion points: Data is retrieved through
supabase_getcalls inSKILL.md. - Boundary markers: No specific delimiters or instructions are provided to the agent to treat external database content as untrusted.
- Capability inventory: The skill uses
curlfor network access and shell utilities likejq,grep, anddatefor data processing. - Sanitization: The provided templates do not demonstrate validation or escaping of the data fetched from the API before it is processed by other tools.
- [COMMAND_EXECUTION]: The skill uses shell commands including
jqfor parsing JSON responses andgrepto inspect HTTP headers. - [EXTERNAL_DOWNLOADS]: The skill performs network operations against
supabase.codomains, which is a well-known database service. - [DYNAMIC_EXECUTION]: The skill uses the
sourcecommand to dynamically load a helper script located at a relative path../../scripts/supabase-api.sh.
Audit Metadata