Security audit

Supabase Security Audit

Security checks across malware telemetry and agentic risk

Overview

This Supabase audit skill appears purpose-built, but it needs review because it uses powerful database credentials and live database probes with broad triggering and unsafe defaults.

Review before installing or running, especially on production. Use staging or temporary least-privilege credentials where possible, explicitly approve any credential access and live probes, pin and verify the pg dependency, enable proper TLS verification, and treat the hotfix SQL as a manual migration that needs normal review.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to access a local credentials file containing highly sensitive Supabase secrets, including a service-role key and database password, yet no explicit permission boundary is declared in the skill metadata. That creates a capability/consent gap: an agent may read and use privileged local secrets without the user clearly understanding that this skill requires secret-file access.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior materially exceeds and diverges from the stated purpose: it reads privileged local credentials, connects directly to Postgres with powerful secrets, and performs live mutation probes while presenting itself as a general audit skill. This mismatch is dangerous because users may invoke it expecting passive analysis, while it actually exercises high-risk capabilities against production infrastructure using service-role and DB credentials.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The header comment materially misrepresents behavior by claiming the audit is effectively read-only while the script performs live UPDATE statements against application data, even if wrapped in a transaction. This is dangerous because operators may run it in production under a false assumption of non-mutating behavior, and side effects can still occur through triggers, audit logs, notifications, or mis-scoped transactional handling.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The skill's broad description and activation guidance make it likely to be invoked on generic security-related requests, even when the user did not intend to authorize database-level auditing with privileged credentials. In this context, over-broad triggering is risky because the skill is not a harmless informational helper; it can access secrets and probe live systems.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The 'When to Run' triggers are ambiguous and contain no negative examples or scope limits, so an orchestration layer may invoke this skill for routine discussion of security, auth, or migrations. Because this skill uses privileged project credentials and may run active probes, accidental invocation could expose secrets or cause unauthorized interaction with production resources.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/audit.js:108

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/audit.js:110