Supabase

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.6

Overview

The skill is coherent for Supabase management, but its setup instructions include unverified remote installer execution and it can perform sensitive Supabase admin actions.

Review before installing. Prefer a verified or package-managed oo CLI installation instead of running the pipe-to-shell setup commands, and only approve write or destructive Supabase actions after checking the exact project, key, secret, storage object, and payload.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:77

Finding

Unverified Remote Installer Retrieval and Immediate Shell Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 77–81
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The first-time setup instructions download mutable scripts from an external server and pass their contents directly to a command interpreter. The Unix command pipes the response into bash, while the Windows command uses Invoke-Expression through the iex alias.

Neither instruction pins an installer version, verifies a cryptographic checksum or signature, nor allows inspection before execution. Consequently, the code that ultimately executes can differ from the content reviewed during this audit. Although the download host is presented as the Skill vendor's domain and installation is only suggested when the CLI is unavailable, those facts do not provide payload integrity.

Installing the CLI is relevant to the declared functionality, but immediate execution of an unverified remote response is not the minimum privilege or safest mechanism necessary to install it. This creates an avoidable supply-chain code-execution channel.

Attack Path

1. The oo CLI is absent, causing an Agent or user to follow the first-time setup instructions.
2. An attacker compromises the installer host, publication pipeline, DNS resolution, TLS trust chain, or another component capable of controlling the returned response.
3. The installer endpoint returns an attacker-controlled shell or PowerShell payload.
4. bash or iex executes the response immediately, without integrity verification or review.
5. The payload performs arbitrary actions using the permissions of the Agent or user who launched the command.

Impact Assessment

Successful exploitation provides ...[truncated 800 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct download-to-interpreter patterns.
2. Prefer a trusted platform package manager or a version-pinned release artifact from the vendor's authenticated release repository.
3. Separate download and execution into distinct steps so the artifact can be inspected before use.
4. Publish SHA-256 or stronger checksums through an independently protected channel and require verification before execution.
5. Prefer cryptographic release signatures and verify them against a pinned, documented signing key.
6. Pin the installer or package to an explicit version rather than using a mutable generic installer URL.
7. Execute installation with ordinary user privileges unless a specific installation step demonstrably requires elevation.
8. Document the files, network destinations, and permissions required by the installer.
9. If automated installation remains necessary, fail closed when signature or checksum verification fails.

A safer workflow is: download a versioned artifact, verify its signature and expected digest, inspect or unpack it, and only then execute the verified installer as a separate command.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to install the CLI via curl ... | bash, which fetches a remote script and immediately executes it without verification, pinning, or integrity checks. This is dangerous because compromise of the hosting domain, transport path, or install script can lead to arbitrary code execution on the user's machine; the fact that it appears only in a fallback setup section reduces frequency, but not severity.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says to use this skill for "ANY Supabase request" and instead of calling the API directly, which is an overly broad trigger that can cause automatic routing of a wide range of sensitive database, storage, and administrative tasks into a powerful connector. In this skill context, that is risky because the available actions include write and destructive operations such as deleting secrets and API keys, so vague invocation criteria can increase the chance of unintended high-impact use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.