supabase-security

The security analysis of the 'supabase-security' skill confirms its legitimacy as a defensive tool. The following points summarize the technical findings:

• [COMMAND_EXECUTION]: The skill provides several Node.js scripts (audit.js, discover.js, cli.js) intended to be run by the user to perform security checks. These scripts execute SQL queries via the Supabase Management API and probe for public accessibility of database tables.
• [EXTERNAL_DOWNLOADS]: The auditing logic requires network access to api.supabase.com to fetch project metadata and configuration. Additionally, the tool hit the user's specific Supabase project URL (e.g., *.supabase.co) to perform 'active probes'—attempting unauthenticated requests to confirm if data leaks exist. These operations are essential for the tool's auditing functionality.
• [DATA_EXFILTRATION]: The GitHub Action wrapper (action.yml) features an optional webhook-url input. If a user explicitly configures this, the scan results (vulnerability findings and statistics) are POSTed to that URL. Analysis of the result structure shows that findings include vulnerability summaries and metadata, but sensitive credentials like Personal Access Tokens or project keys are not included in the exported JSON.
• [DATA_EXPOSURE]: The 'discover' mode scans local repository files (such as .env) to find Supabase references and keys. This is used solely for the local audit report and is not transmitted externally. The reports include remediation SQL for found issues, helping users harden their security posture.