The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides access to the SUPABASE_GET_PROJECT_API_KEYS tool in SKILL.md, which facilitates the retrieval of live service-role API keys. These credentials grant full administrative access to the associated Supabase project and database.
[COMMAND_EXECUTION]: The inclusion of the SUPABASE_BETA_RUN_SQL_QUERY tool in SKILL.md enables the execution of arbitrary PostgreSQL statements. This capability allows for complete database manipulation, including modifying schemas, deleting data, and potentially escalating privileges within the database environment.
[DATA_EXFILTRATION]: The skill combines high-privilege read operations (such as fetching secrets and table data) with an external connection to an MCP server, creating a potential pathway for sensitive data exfiltration.
[EXTERNAL_DOWNLOADS]: Setup instructions in SKILL.md require the user to configure a third-party MCP server endpoint at https://rube.app/mcp to enable the skill's functionality.
[PROMPT_INJECTION]: A significant attack surface for indirect prompt injection is present because the agent processes untrusted data from external sources.
Ingestion points: Data is ingested from database tables and views via SUPABASE_SELECT_FROM_TABLE and SUPABASE_LIST_TABLES in SKILL.md.
Boundary markers: The instructions lack delimiters or specific directives to treat data retrieved from the database as untrusted content.
Capability inventory: The agent possesses powerful capabilities, including arbitrary SQL execution (SUPABASE_BETA_RUN_SQL_QUERY) and credential access (SUPABASE_GET_PROJECT_API_KEYS) in SKILL.md.
Sanitization: There is no requirement or guidance for sanitizing or escaping content fetched from the database before it is used in subsequent reasoning or tool execution.

supabase-automation