ClawHub
Back to skill

Security audit

database

Security checks for vulnerabilities and agentic risk

Overview

This is a real Supabase database tool, but it needs Review because it can use full-power database credentials and has unsafe handling around destructive commands and vector-search data.

Install only if you are comfortable giving this skill a Supabase service-role key and sending vector-search queries to the external embedding service. Prefer a non-production project or least-privilege key, verify SUPABASE_URL carefully, avoid sensitive text in vector-search queries, and manually review any update, delete, upsert, raw SQL, or RPC command before running it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/supabase.sh:229
Finding

Mutation Safety Guard Can Be Bypassed Without a Row Predicate

Content
View full analysis
&2 exit 1 fi local url="${REST_URL}/${table}?${filters:1}" api_request PATCH "$url" "$data" | jq . ``` ```bash # Delete from table local filters filters=$(build_filters "$@") if [[ -z "$filters" ]]; then echo "Error: At least one filter required for delete (use --eq)" >&2 exit 1 fi local url="${REST_URL}/${table}?${filters:1}" api_request DELETE "$url" | jq . ``` ### Technical Analysis The safety checks for `update` and `delete` only verify whether `build_filters` returned a nonempty query string. They do not verify that the string contains a row-selection predicate. Non-predicate options such as `--order`, `--limit`, or `--offset` can make the query string nonempty. In particular, `--order` produces an `order=...` parameter but does not constrain which rows match the request. Consequently, the script may send a `PATCH` or `DELETE` operation that applies to every row exposed by the target table. This contradicts the command documentation, which states that update and delete operations require an `-- ...[truncated 1488 chars]
Remediation
View remediation
&2 exit 1 fi ``` ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/supabase.sh:15
Finding

Unvalidated Supabase Endpoint Can Receive a Full-Privilege Service Credential

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description says it triggers on broad categories like 'requests involving databases, vector stores, embeddings' rather than narrowly scoping to explicit Supabase requests. In an agentic environment, this can cause the skill to activate for unrelated data tasks and expose powerful database capabilities, especially because the documented setup uses a Supabase service role key with full access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation presents destructive operations like update and delete as routine commands without prominent warnings, confirmation requirements, or safety constraints. This is more dangerous in context because the skill instructs use of SUPABASE_SERVICE_KEY, which bypasses Row Level Security, so accidental or mis-triggered writes could modify or delete sensitive production data at full privilege.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The vector-search command sends the user’s raw query text to a third-party HeyBoss embedding API, which expands the trust boundary beyond Supabase and can leak sensitive prompts, search terms, or embedded secrets. Because this transmission is built into a database utility script and is not strongly disclosed at the point of use, users may unintentionally exfiltrate confidential data to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The hardcoded external endpoint confirms that vector-search depends on a third-party service outside the primary database platform. That dependency is security-relevant because it introduces additional data recipients, policy/compliance concerns, and potential unexpected exfiltration of user-entered search content.

Content

Scanner excerpt · scripts/supabase.sh (reported line 362)May include surrounding context.

sh
fi

    local embedding
    embedding=$(curl -s https://api.heybossai.com/v1/pilot \
        -H "Authorization: Bearer ${SKILLBOSS_API_KEY}" \
        -H "Content-Type: application/json" \
        -d "{\"type\": \"embedding\", \"inputs\": {\"input\": $(printf '%s' "$query" | jq -Rs .)}}" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The hardcoded external endpoint confirms that vector-search depends on a third-party service outside the primary database platform. That dependency is security-relevant because it introduces additional data recipients, policy/compliance concerns, and potential unexpected exfiltration of user-entered search content.

Content

Scanner excerpt · scripts/supabase.sh (reported line 362)May include surrounding context.

sh
fi

    local embedding
    embedding=$(curl -s https://api.heybossai.com/v1/pilot \
        -H "Authorization: Bearer ${SKILLBOSS_API_KEY}" \
        -H "Content-Type: application/json" \
        -d "{\"type\": \"embedding\", \"inputs\": {\"input\": $(printf '%s' "$query" | jq -Rs .)}}" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script transmits user-supplied query content to an external embedding endpoint without an inline warning, consent prompt, or clear disclosure in the vector-search command description. This creates a privacy and data-handling risk because operators may reasonably assume their search text remains within the Supabase environment when it is actually sent to a separate vendor.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The top-level comment presents the script generically as a Supabase CLI for database operations and vector search, but the actual interface includes insert, update, delete, upsert, arbitrary RPC calls, and raw SQL execution. This is not merely incomplete implementation detail when the file-level documentation is the only stated intent available and it omits especially powerful behaviors.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.