ClawHub
Back to skill

Security audit

Supabase Security Audit

Security checks for vulnerabilities and agentic risk

Overview

This security-audit skill is mostly purpose-aligned, but it asks for powerful Supabase secrets and runs them through unsafe dependency loading, disabled database TLS verification, and unvalidated SQL input.

Install only after narrowing when the skill runs, removing the unused service-role key requirement, using pinned project-local dependencies, enabling PostgreSQL certificate verification, validating probe IDs as UUIDs or parameterizing claims, and preferably using a dedicated least-privileged audit database role instead of production administrator credentials.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/audit.js:207
Finding

SQL Injection Through Unvalidated Probe UID

Content
View full analysis
`. Injected SQL could attempt to reset the role or otherwise abuse privileges available to the session. The surrounding transaction and final rollback are not reliable security boundaries. Injected statements could manipulate transaction state, invoke functions with external effects, read protected information, or execute operations whose consequences are not fully neutralized by rollback. ### Attack Path 1. An attacker controls or influences the `--probe-uid` argument supplied to the audit. 2. The malicious value is interpolated into the `SET LOCAL request.jwt.claims` SQL statement. 3. The value terminates the expected string literal and appends attacker-selected SQL. 4. The injected statements execute through the privileged PostgreSQL connection. 5. Depending on database permissions and installed functionality, the attacker may read or modify project data, alter policies or roles, or compromise database integrity. ### Impact Assessment Successful exploitation can provide unauthorized database access within the privileges of the connection. Potential scope includes: - Reading data protect ...[truncated 272 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/audit.js:106
Finding

PostgreSQL TLS Certificate Verification Is Disabled

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/audit.js:30
Finding

Local Code Execution Through Predictable Temporary Module Loading

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:34
Finding

Unpinned Runtime Dependency Installation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/audit.js:53
Finding

Unnecessary Collection of Supabase Service-Role Credentials

Content
View full analysis
l.includes('=') && !l.trim().startsWith('#')) .map(l => { const i = l.indexOf('='); return [l.slice(0, i).trim(), l.slice(i + 1).trim()]; }) ); for (const k of ['SUPABASE_URL', 'SUPABASE_PROJECT_REF', 'SUPABASE_ANON_KEY', 'SUPABASE_SERVICE_ROLE_KEY', 'SUPABASE_DB_PASSWORD']) { if (!cred[k]) { console.error('ERR: missing', k, 'in', credPath); process.exit(2); } } ``` The documentation requires the same unused secret: ```text SUPABASE_SERVICE_ROLE_KEY=... ``` ### Technical Analysis The script requires and loads `SUPABASE_SERVICE_ROLE_KEY`, but the reviewed implementation never uses that value. The service-role key normally bypasses Supabase row-level security and is therefore a highly privileged secret. Requiring this credential exceeds the minimum privileges necessary for the declared audit functions. It also unnecessarily exposes the key to all executable modules loaded by the process, including any module obtained through the unsafe `/tmp` dependency path. The generic environment-file parser additionally imports every assignment from the selected file rather than limiting parsing to required keys. No direct transmission of the service-role key by the reviewed code was found. The risk arises from unnecessary collection and expanded exposure. ### Attack Path 1. A user follows the documentation and places the service-role key in the credentials file. 2. The audit reads the complet ...[truncated 785 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code substantially matches several declared audit areas: RLS coverage, anonymous exposure, privilege escalation, cross-customer data leaks, and HTTP security headers. However, there are material omissions relative to the declared purpose. First, the description says the skill can 'apply hotfix templates when issues are found,' but the script only reports findings and never modifies code/configuration or emits fix templates. Second, the description includes 'magic-link flow correctness,' but no logic examines authentication flows, redirects, tokens, or email link behavior. Third, the description frames this as a 'Supabase + Vercel project' audit, yet the code only interacts with Supabase credentials, Supabase REST, Postgres, and a generic site URL for headers; it contains no Vercel-specific inspection. These are meaningful description-versus-behavior gaps, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill explicitly instructs the use of a credentials file containing SUPABASE_SERVICE_ROLE_KEY and database password, which are highly sensitive secrets capable of bypassing normal client restrictions. In an agent setting, centralizing and referencing these credentials increases the chance of accidental disclosure, misuse by an over-privileged skill, or execution of powerful operations against production data.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Prerequisites

Credentials file at ~/.openclaw/credentials/supabase/credentials.env (override path with --cred) containing:

text
SUPABASE_URL=https://<ref>.supabase.co

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
Then re-run `audit.js` to confirm the finding flipped to ✅.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md
Then re-run `audit.js` to confirm the finding flipped to ✅.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/threat-patterns.md (reported line 12)May include surrounding context.

Pattern

sql
create policy profiles_self_update
  on public.profiles
  for update
  using (auth.uid() = id);   -- no WITH CHECK

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/hotfix-role-lock.sql (reported line 20)May include surrounding context.

text
**Pattern**

```sql
create policy profiles_self_update
  on public.profiles
  for update
  using (auth.uid() = id);   -- no WITH CHECK

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/hotfix-role-lock.sql (reported line 22)May include surrounding context.

text
**Pattern**

```sql
create policy profiles_self_update
  on public.profiles
  for update
  using (auth.uid() = id);   -- no WITH CHECK

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.js (reported line 7)May include surrounding context.

js
* Supabase project and prints a human-readable report.
 *
 * USAGE:
 *   node audit.js [--cred ~/.openclaw/credentials/supabase/credentials.env]
 *                 [--pooler aws-1-eu-central-1.pooler.supabase.com:6543]
 *                 [--public-tables profiles,deals,documents,...]
 *                 [--probe-uid <uuid>]   # an existing customer-role user id

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.js (reported line 53)May include surrounding context.

js
* Supabase project and prints a human-readable report.
 *
 * USAGE:
 *   node audit.js [--cred ~/.openclaw/credentials/supabase/credentials.env]
 *                 [--pooler aws-1-eu-central-1.pooler.supabase.com:6543]
 *                 [--public-tables profiles,deals,documents,...]
 *                 [--probe-uid <uuid>]   # an existing customer-role user id

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/hotfix-role-lock.sql (reported line 19)May include surrounding context.

text
reset role;

-- 1. Replace the existing self-update policy with one that locks role + email.
drop policy if exists profiles_self_update on public.profiles;

create policy profiles_self_update

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs use of environment-backed secrets and a credentials file containing highly privileged Supabase keys, but it does not declare any explicit tool scope or permission boundary. In an agent ecosystem, missing scope declarations can let a broadly-invoked skill access sensitive credentials or environment data without clear operator intent or review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description defines broad activation criteria around general 'security' or 'audit' requests, increasing the chance the agent invokes a credentialed, security-sensitive skill in situations that do not require it. Over-broad routing raises the risk of unnecessary secret exposure, unintended probing of production systems, or execution of privileged audit workflows from loosely related prompts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The 'When to Run' triggers include ambiguous phrases like 'are we secure?' and 'before exposing a new surface,' which lack clear scope boundaries for a privileged audit skill. In context, this can cause the agent to overuse a skill that expects access to service-role secrets and live environment details, expanding operational risk beyond justified cases.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code reads high-sensitivity values including SUPABASE_SERVICE_ROLE_KEY and SUPABASE_DB_PASSWORD from a credentials file and later uses them for database and API access. While the header documents required variables, there is no runtime confirmation, warning, or visible notice when the script accesses these credentials, which fits the missing-warning criterion for sensitive credential access in code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The script performs HTTPS requests to the Supabase REST API and sends authentication material in the apikey and Authorization headers. Although the overall audit purpose is described in comments, the code does not provide a visible runtime warning that authenticated requests will be sent to the configured Supabase project, which is a safety-relevant network action.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This markdown file includes a natural-language/code example that restricts allowed origins to specific domains, including a country-specific .co.il domain, without explicitly stating that these values are only illustrative and must be replaced for each deployment. That can be read as prescribing a fixed locale/domain policy rather than offering a user or project-specific choice.

Content

No source excerpt is available for this finding.