supabase
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent on how to ingest and process data from external, potentially untrusted sources (Supabase Database, Realtime broadcasts, and Storage buckets) while granting it high-privilege capabilities such as database migration execution and network requests via Edge Functions and pg_net. This creates a surface for indirect prompt injection attacks.
- Ingestion points: Data retrieved from tables through the Data API (PostgREST), Realtime broadcast messages, and file content downloaded from Storage buckets.
- Boundary markers: The instructions consistently advocate for Row-Level Security (RLS) on all exposed schemas and the use of app_metadata for authorization to isolate user contexts.
- Capability inventory: The agent is authorized to perform database schema migrations (writing to the local or remote file system), execute database functions, and trigger outbound network requests through Edge Functions and the pg_net extension.
- Sanitization: The documentation explicitly warns the agent to sanitize inputs for PostgREST filters (e.g., .filter(), .or()) in the DATA-API.md file and recommends using parameterized database functions (RPCs) to avoid dynamic SQL injection risks.
Audit Metadata