supabase
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill actively promotes security best practices, including detailed guidance on Row-Level Security (RLS), authentication, and the principle of least privilege for database functions.
- [SAFE]: All external references and network operations target official Supabase domains and repositories, such as
supabase.comand thesupabase/agent-skillsGitHub repository, which are recognized as well-known and trusted sources. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from official documentation and changelogs to influence its behavior. This surface is considered safe as it relies exclusively on official vendor sources.
- Ingestion points: Fetches content from
https://supabase.com/changelog.mdand documentation pages viasupabase.com/docs/*.md(SKILL.md). - Boundary markers: No explicit delimiters are specified for the fetched data.
- Capability inventory: The skill uses database tools like
execute_sqland thesupabaseCLI, and possesses the capability to create GitHub issues for user feedback (references/skill-feedback.md). - Sanitization: No explicit sanitization of fetched documentation content is mentioned, as the content originates from the official vendor.
Audit Metadata