supabase
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official Supabase CLI and JavaScript SDK from well-known registries including npm and esm.sh.
- [COMMAND_EXECUTION]: Utilizes standard Supabase CLI commands for local development environment setup and project deployment.
- [INDIRECT_PROMPT_INJECTION]: The skill manages the attack surface of processing user-provided schema requirements by mandating the use of Row-Level Security (RLS) policies and PostgreSQL triggers to ensure data isolation.
- Ingestion points: User prompts described in Example 1 and Example 2 (SKILL.md).
- Boundary markers: Standard markdown code blocks for generated code.
- Capability inventory: CLI execution (npm, supabase) and local file creation.
- Sanitization: Instructions strictly require RLS enablement on all tables and the use of auth.uid() for identity verification.
- [SAFE]: Promotes secure handling of sensitive keys by using environment variables and provides clear documentation on distinguishing between public anonymous keys and private service role keys.
Audit Metadata