supabase-pentest
Fail
Audited by Snyk on Feb 15, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs extracting and recording credentials (e.g., anon_key, service_key, JWTs) into .sb-pentest-context.json and curl-commands.sh and to save evidence with verbatim secrets, which forces the agent to output secret values.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). The skill requires a public target URL ("Prerequisites: A public URL of the application to audit") and its phases (detection, key extraction, API/storage/auth audits) explicitly fetch and analyze content from that external site (client-side code, APIs, storage), meaning it ingests untrusted third-party content as part of its workflow.
Audit Metadata