postgres-best-practices

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content includes explicit patterns that can be used to exfiltrate data and secrets (e.g., a trigger/function that posts row JSON and the SUPABASE_SERVICE_ROLE_KEY in an Authorization header, MCP server config exposing a service role key, and security-definer functions/triggers that can call external endpoints), which enable credential theft and remote data exfiltration/backdoor behavior if misused.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes runtime remote imports/executables that would fetch and run code (e.g., Deno/ESM imports https://deno.land/std@0.168.0/http/server.ts and https://esm.sh/@supabase/supabase-js@2, and an npx invocation of @supabase/mcp-server) which are fetched at runtime and execute remote code required for the shown Edge Function / MCP workflows.