volcengine-db-supabase

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes direct CLI examples that pass and retrieve credentials (e.g., configure set --access-key --secret-key, exporting VOLCENGINE_ACCESS_KEY/SECRET_KEY, and projects api-keys), which would require the agent to accept, substitute, or print secret values verbatim in commands or outputs, creating an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most URLs are official docs/CDNs and look benign, but a direct ZIP download hosted on a third‑party CDN and a domain that appears to be a typosquat of the official Volcengine console raise moderate risk for executable/malicious distribution or phishing.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 skill 的必需运行流程是通过 scripts/supabase_dataplane.py 调用 execute_action() 来接收/读取调用者传入的 --query/--query-file/--source-code 等自由文本并直接作为 SQL 或部署源代码内容注入到 runtime API（如 db query、deploy-edge-function），属于先于选择具体条目的“用户可控文本摄取”。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes commands that fetch and execute remote code: a curl download of a demo zip (https://lf3-static.bytednsdoc.com/obj/eden-cn/whkph/ljhwZthlaukjlkulzlp/nextjs-supabase-filebox.zip) which is then unpacked and deployed, and Edge Function examples that import runtime code from https://esm.sh/@supabase/supabase-js@2 (remote module loading in Deno), both of which cause remote code to be fetched and executed at runtime.