volcengine-db-supabase
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/supabase_dataplane.pyinvokes theve(Volcengine) CLI usingsubprocess.runto retrieve workspace configuration, API keys, and endpoints. The commands are constructed using predefined action strings. - [EXTERNAL_DOWNLOADS]: The skill references standard public registries for installing the
supabasePython package and the@supabase/supabase-jsNode.js library, which are the official clients for the service being managed. - [PROMPT_INJECTION]: Static detections for instruction concealment were evaluated and found to be security guardrails. The skill explicitly instructs the agent to avoid printing sensitive credentials (API keys, JWT secrets, passwords) in final responses to the user.
- [CREDENTIALS_UNSAFE]: The skill documentation includes best practices for credential management, such as storing
DATABASE_URLin local files with restricted permissions (chmod 600) and verifying connectivity without exposing secrets.
Audit Metadata