supabase-automation
Warn
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
SUPABASE_BETA_RUN_SQL_QUERYtool, enabling the execution of arbitrary PostgreSQL statements. This allows for full control over the database environment, including the potential for data loss or unauthorized schema changes.\n- [CREDENTIALS_UNSAFE]: The skill includes instructions for utilizing theSUPABASE_GET_PROJECT_API_KEYStool to retrieve live service-role API keys. Access to these high-privilege secrets poses a substantial security risk regarding data exposure and persistence.\n- [EXTERNAL_DOWNLOADS]: The skill connects to and utilizes functionality from the official Rube/Composio MCP endpoint athttps://rube.app/mcp.\n- [PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection due to its handling of untrusted database content.\n - Ingestion points: Data is ingested from tables and views through tools like
SUPABASE_SELECT_FROM_TABLEandSUPABASE_BETA_RUN_SQL_QUERY.\n - Boundary markers: There are no explicit markers or instructions provided to separate retrieved data from the agent's core operational logic.\n
- Capability inventory: The agent has access to highly impactful capabilities, including arbitrary SQL execution and credential retrieval.\n
- Sanitization: Although the skill suggests using read-only SQL and masking keys in outputs, it lacks general sanitization for arbitrary data returned from the database.
Audit Metadata