T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:33- Finding
Unauthenticated Privileged Supabase Data Proxy with Caller-Controlled Query Selection
- Content
View full analysis
- Remediation
View remediation
Security audit
Supabase Dashboard Builder
Security checks for vulnerabilities and agentic risk
Overview
The skill is not deceptive or self-executing, but its dashboard template teaches an unsafe privileged Supabase proxy pattern that could expose sensitive admin data if copied into production.
Review this skill carefully before installing or using it to generate production code. If used, require authentication and authorization on every dashboard endpoint, avoid service-role keys for user-shaped reads where possible, hardcode safe table and column projections, bound pagination, encode upstream query parameters safely, and restrict CORS to explicit trusted origins.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:154- Finding
Unrestricted Cross-Origin Resource Sharing Configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example exposes a server endpoint that performs client-driven reads against Supabase using the service-role key, which bypasses row-level security and elevates every allowed read to highly privileged access. Even with a table allowlist, user-controlled table, select, limit, and offset parameters can enable broad extraction of sensitive administrative data from internal tables that were never meant to be readable by dashboard users.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guidance recommends fully permissive CORS (allow_origins, allow_methods, and allow_headers all set to "*") for an admin dashboard backend without warning about the consequences. For a privileged dashboard API, this weakens origin-based isolation and makes it easier for arbitrary websites to issue cross-origin requests to the backend from a victim's browser, especially if authentication is later added via cookies or other ambient credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Including wildcard CORS in instructional content for a Supabase-backed admin dashboard, without any security warning or scoping guidance, is unsafe because readers may copy it directly into production. In this context the backend fronts sensitive operational data, so normalizing permissive cross-origin access increases the chance of unintended data exposure or abuse once the API evolves beyond simple local development.
- Content