The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external Supabase RPC API responses during the audit process.
Ingestion points: Data returned from POST /rest/v1/rpc/[function_name] calls in SKILL.md.
Boundary markers: The instructions do not specify delimiters or boundary markers for the processing of these API responses.
Capability inventory: The skill uses curl for network requests and performs file writes to local project files (.sb-pentest-context.json).
Sanitization: There are no explicit sanitization steps described for the ingested data; however, the skill is intended for security analysis and encourages redacting PII in reports.
[COMMAND_EXECUTION]: The skill utilizes curl commands to interact with Supabase project endpoints for testing purposes. These commands are a standard and necessary part of the auditing workflow described and use clear, parameterized formats.
[SAFE]: The skill follows security best practices for audit tools, such as recommending the use of environment variables for keys ($ANON_KEY) and providing guidance on redacting sensitive data (PII) from findings before documentation.

supabase-audit-rpc