supabase
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches documentation, changelogs, and security guides from official Supabase domains (e.g., supabase.com). These resources are provided by a well-known service for project configuration and guidance.
- [COMMAND_EXECUTION]: Utilizes the Supabase CLI for database management, migration handling, and security auditing (e.g.,
supabase db advisors). A reachability check is performed viacurlto the vendor's MCP server endpoint. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect injection as it ingests data from external documentation and changelogs.
- Ingestion points: Documentation fetched via the
search_docstool and direct URL retrieval from supabase.com (SKILL.md). - Boundary markers: Not explicitly defined for the interpolation of fetched documentation content.
- Capability inventory: The skill can execute SQL via MCP tools or the CLI and perform local file operations for migrations.
- Sanitization: No specific sanitization or filtering is described for the ingested documentation content, though the source is a trusted vendor repository.
Audit Metadata