ClawHub
Back to skill

Security audit

Supabase

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a real Supabase helper, but it gives an agent broad database-admin power and can send vector-search queries to OpenAI, so it needs review before use.

Install only if you intend to let the agent operate with administrator-level Supabase access. Prefer a test project or restricted credentials where possible, review every write/delete/raw-SQL action before it runs, and avoid vector-search queries containing secrets, customer data, or proprietary text unless sending that text to OpenAI is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill exposes shell-based operational capability via `{baseDir}/scripts/supabase.sh` but does not declare corresponding permissions or execution expectations. This weakens policy enforcement and user/operator awareness, increasing the chance that a database-capable shell tool is invoked in contexts where command execution was not intended or adequately constrained.

Tp4

High
Category
MCP Tool Poisoning
Confidence
83% confidence
Finding
The skill is presented as a Supabase integration, but the vector-search flow also depends on OpenAI for embeddings via `OPENAI_API_KEY`. This creates an undeclared data egress path where user queries or corpus-related content may be sent to an external AI provider, with privacy, compliance, and trust implications beyond the stated purpose.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill’s stated purpose is Supabase operations, but its vector-search path also transmits user-provided query text to OpenAI to generate embeddings. This creates an undocumented third-party data flow that can expose sensitive prompts, search terms, or proprietary content to an external provider, which is especially risky in a database-oriented skill where users may assume all processing stays within Supabase.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Requiring OPENAI_API_KEY introduces access to a third-party API that is not justified by the declared Supabase-only scope of the skill. This expands the trust boundary and may cause operators to provision an additional secret and permit external data transmission they did not expect.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The trigger text is broad enough to activate on generic database, vector store, or embedding requests, not just clear Supabase-specific intents. Over-triggering increases the chance that a high-privilege database skill is selected inappropriately, exposing shell/database operations in conversations where a narrower or safer tool should have been used.

Missing User Warnings

High
Confidence
91% confidence
Finding
The documentation includes destructive operations such as `delete`, `update`, raw SQL, and table creation/management without any warning, safety interlock, or confirmation requirement. In a skill that uses privileged Supabase credentials and can bypass RLS, this materially raises the risk of accidental or induced data loss, corruption, or schema damage.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The setup instructs users to export `SUPABASE_SERVICE_KEY`, a high-privilege secret that bypasses Row Level Security, without prominently warning about its sensitivity or blast radius. If mishandled, logged, or used in the wrong context, it can provide broad unauthorized access to database contents and administrative data operations.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The vector-search command sends raw user query text to OpenAI without any warning, confirmation, or data-classification check. If users submit secrets, internal document fragments, customer data, or sensitive search strings, that content is transmitted outside Supabase to a separate service, creating confidentiality and compliance risks.

External Transmission

Medium
Category
Data Exfiltration
Content
fi
    
    local embedding
    embedding=$(curl -s https://api.openai.com/v1/embeddings \
        -H "Authorization: Bearer ${OPENAI_API_KEY}" \
        -H "Content-Type: application/json" \
        -d "{\"input\": $(printf '%s' "$query" | jq -Rs .), \"model\": \"text-embedding-ada-002\"}" \
Confidence
92% confidence
Finding
curl -s https://api.openai.com/v1/embeddings \ -H "Authorization: Bearer ${OPENAI_API_KEY}" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
fi
    
    local embedding
    embedding=$(curl -s https://api.openai.com/v1/embeddings \
        -H "Authorization: Bearer ${OPENAI_API_KEY}" \
        -H "Content-Type: application/json" \
        -d "{\"input\": $(printf '%s' "$query" | jq -Rs .), \"model\": \"text-embedding-ada-002\"}" \
Confidence
92% confidence
Finding
https://api.openai.com/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.