supabase-audit-auth-signup
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: CRITICALINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Supabase API endpoints during the authentication audit process.
- Ingestion points: Supabase Auth API registration responses (SKILL.md).
- Boundary markers: No explicit delimiters are used for API response strings, though the skill logic focuses on status codes and structured JSON fields.
- Capability inventory: The skill utilizes shell commands (curl) for testing and performs local file writes to store evidence and logs (SKILL.md).
- Sanitization: Risk is mitigated by the skill's specific focus on auditing structured responses rather than executing content from the target API.
- [SAFE]: The skill is a standard pentesting utility. The inclusion of disposable email domains is for the purpose of testing registration filters and does not constitute a security risk.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata