Supabase LangGraph Checkpointer

• Risk level: Low
• Analyzed: Feb 24, 2026, 2:16 AM
• Findings: 0
• Version: 1.0.0

Overview

The package implements a Supabase-backed LangGraph checkpointer and its code and instructions align with that purpose; the main risk is handling the sensitive Supabase service key (not requested in metadata) and ensuring least-privilege access.

This skill appears to do exactly what it says: save LangGraph checkpoints to Supabase via the PostgREST client you provide. Before installing or using it, consider: (1) credential sensitivity — the example suggests using a Supabase key (service_role key is mentioned). Use least-privilege credentials or Row Level Security policies rather than your project-wide service_role key when possible. (2) Data sensitivity — checkpoints are serialized JSONB; avoid storing secrets in checkpoint payloads. (3) Review and run the provided SQL (create_tables.sql) in your Supabase project so you control schema and permissions. (4) Verify which Supabase Python client you use (the example uses create_client) and ensure it is an official/expected library. If you need more assurance, ask the author how credentials and RLS are expected to be configured and whether anon or dedicated restricted keys can be used.