supabase-help
Fail
Audited by Snyk on Feb 15, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt includes extraction skills (anon/service keys, JWTs, DB strings) and evidence files (curl-commands.sh, extraction evidence) which imply the agent must output found secrets verbatim into reports/commands, creating an exfiltration risk.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill accepts and actively fetches content from arbitrary target URLs (e.g., /supabase-pentest , /supabase-extract-url , /supabase-audit-buckets-read) and reads/extracts data from those external web apps and storage buckets as part of its audit workflow, exposing the agent to untrusted, user-controlled third‑party content.
Audit Metadata