supabase-audit-buckets-public

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly fetches and inspects files from public Supabase storage URLs (e.g., https://abc123def.supabase.co/storage/v1/object/public/backups/secrets.env and other public-url-tests) which are user-uploaded/public web content that the agent is expected to read and analyze, exposing it to untrusted third-party content.