The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes Bash(supabase:*), Bash(psql:*), and Bash(npx:*) to perform database migrations, execute administrative queries, and run runtime scripts such as security audits and cost monitors.
[DATA_EXFILTRATION]: The cost monitoring script (scripts/supabase-cost-monitor.ts) fetches usage metrics from the Supabase Management API and transmits this data to external services via Slack webhooks.
[COMMAND_EXECUTION]: The security audit logic in scripts/supabase-security-audit.ts relies on a custom run_sql RPC in the database, which functions as a dynamic execution sink for SQL commands generated by the script.
[PROMPT_INJECTION]: The skill processes untrusted data from database schema metadata (e.g., table and column names) and local migration files, creating a surface for indirect prompt injection if those objects are maliciously named.
Ingestion points: supabase/migrations/*.sql files and outputs from supabase db query or psql tools.
Boundary markers: None present.
Capability inventory: Full file access (Read, Write, Edit), network operations (fetch), and subprocess execution (supabase, psql, tsx).
Sanitization: The provided PL/pgSQL templates use EXECUTE format(...) to escape database identifiers, which is a standard security practice for dynamic SQL construction.

supabase-policy-guardrails