ClawHub
Back to skill

Security audit

Supabase Dashboard Builder

Security checks across malware telemetry and agentic risk

Overview

This skill is not malware, but its template could expose privileged Supabase data if deployed as written.

Install only if you will harden generated dashboards before deployment: add login and admin authorization, restrict CORS to trusted origins, avoid select='*', whitelist tables and columns, cap limits, validate page paths, and protect the Supabase service key.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The skill text explicitly recommends lightweight field selection to avoid large/sensitive columns, but the provided API example still defaults to `select='*'`. In an admin-dashboard context backed by a server-side Supabase service key, this can unnecessarily expose sensitive columns to frontend users and increase performance/time-out risk.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The skill recommends `allow_origins=["*"]` for CORS without warning that this broadens which websites can invoke the API from browsers. Because the API is a thin proxy to Supabase using a privileged service key, permissive CORS materially increases the chance of unintended cross-origin access from untrusted web pages.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal