Supabase Security Auditor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:35 AM UTC
• Version: 1.0.0

Overview

This is a straightforward Supabase security audit skill, with a caution that one example command may print secrets unless the user redacts them.

Install only for projects where you are comfortable letting the agent inspect Supabase configuration and source files. When checking for keys, redact values before sharing reports or transcripts, especially service_role keys, passwords, JWTs, and connection strings.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31

Finding

Unredacted Environment Variables May Expose Supabase Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–32
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Complete Code Snippet:

bash

# Check for exposed keys
grep -rn "SUPABASE_\|supabase\.\(url\|key\|anon\)" .env* src/ | head -10

Technical Analysis

The skill instructs the agent to search .env* and source files for Supabase-related values. Because grep returns the entire matching line without redaction, the command can expose complete credentials—including a SUPABASE_SERVICE_ROLE_KEY—to the agent context and any generated audit report.

Searching for exposed credentials is consistent with the skill's security-audit purpose. However, ingesting complete secret values is unnecessary: variable names, file locations, and redacted value metadata are sufficient to identify insecure storage. The command does not transmit data externally, but secrets may persist in session transcripts, model-processing infrastructure, logs, or reports.

Attack Path

1. The audited project stores a Supabase credential in an .env* file or matching source file.
2. The agent executes the documented grep command during project discovery.
3. grep prints the complete matching line, including the credential value.
4. The secret enters the agent context and may be quoted in the audit report or retained in associated logs.
5. A party with access to that transcript, report, or logging system obtains the credential.
6. If the exposed value is a service_role key, the party can authenticate with elevated Supabase API privileges and bypass Row Level Security within the affected project.

Impact Assessment

The impact depends on the credential discovered. Exposure of an anonymous key generally provides only the access allowed by configured RLS and API policies. Exposure of a service_role key can permit privileged database and storage operations through Supabase APIs, bypass RLS, ...[truncated 279 chars]

Remediation

View remediation

Remediation Suggestions

• Search for variable names and locations without returning raw values.
• Redact everything after the assignment delimiter before output reaches the agent:

  bash

  grep -rnE 'SUPABASE_[A-Z0-9_]*=' .env* src/ 2>/dev/null |
    sed -E 's/(=.*)$/=[REDACTED]/' |
    head -10
  

• Add an explicit instruction that complete API keys, JWTs, passwords, and connection strings must never be displayed, stored, or included in reports.
• Report only the file path, line number, credential type, and whether the value appears hardcoded.
• If a privileged credential has already entered logs or an audit report, remove it where possible, restrict access to affected records, rotate the credential immediately, and review Supabase access logs for unauthorized use.
• Prefer secret-scanning tools configured to mask detected values and to exclude generated files, dependencies, and unrelated directories.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.