T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:16- Finding
Hardcoded Long-Lived Supabase Anonymous API Credential
- Content
View full analysis
Content-Type: application/json ``` ``` ### Technical Analysis The skill embeds a reusable Supabase anonymous-role JWT directly in its documentation and instructs every client to supply it as the API key. The token has a long validity period and can be extracted by anyone who can read the skill package. Supabase anonymous keys are commonly intended for distribution in public clients, so exposure does not by itself grant administrative access. Their security depends entirely on correctly configured Row-Level Security policies, Edge Function authorization, database grants, and rate limiting. If any accessible endpoint has permissive or missing authorization controls, an attacker can reuse this credential independently of the skill to enumerate, create, or modify records allowed to the anonymous role. The documented API also accepts client-provided identifiers such as `user_id` and `pet_id`. Consequently, server-side endpoints must independently verify ownership rather than treating possession of these identifiers or the shared anonymous credential as authorization. ### Attack Path 1. An attacker downloads or reads `SKILL.md`. 2. The attacker copies the embedded Supabase JWT and project URL. 3. The attacker sends arbitrary HTTP requests directly to the documented REST, RPC, or Edge Function endpoints with the copied token in the `apikey` header. 4. The attacker enumerates endpoints and tests whether Row-Level Security, function-level authorization ...[truncated 1279 chars]- Remediation
View remediation