Alibabacloud Analyticdb Postgresql Supabase Ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 0.0.2

Overview

The skill is coherent for managing Alibaba Cloud ADBPG Supabase projects, but it requires risky unverified CLI/plugin installation and handles sensitive project credentials with insufficient safeguards.

Review before installing. Use safer Aliyun CLI installation methods with pinned, verified packages; avoid `curl | bash`, unpinned latest archives, and global plugin auto-update unless you explicitly accept that risk. Treat API keys, service-role keys, dashboard credentials, database passwords, and Alibaba Cloud access keys as secrets: prefer masking, explicit confirmation, least-privilege RAM policies, and rotation after any exposure.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:28

Finding

Mutable Remote Installation Script Is Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:28-31
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: Critical

bash

> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions.

Technical Analysis

The Skill downloads a mutable script from an external URL and sends its response directly to Bash. There is no version pinning, checksum validation, signature verification, local inspection, or confirmation of the final payload.

HTTPS protects data in transit but does not establish that the remotely served script is immutable or safe. The effective code can change after the Skill package has been audited. Compromise of the CDN, vendor release process, hosting account, DNS resolution path, or referenced script could therefore turn the prerequisite workflow into arbitrary code execution.

This behavior is not the minimum privilege necessary to manage ADBPG Supabase projects. Installing the CLI may be a legitimate prerequisite, but executing an unverified remote script is not required to satisfy that prerequisite safely.

Attack Path

1. An attacker compromises the remote script, CDN, hosting pipeline, or another component capable of changing the response.
2. The user or agent follows the mandatory prerequisite workflow.
3. curl retrieves the attacker-controlled response.
4. The pipe sends the response directly to Bash without an inspection or verification boundary.
5. The payload executes with the privileges of the agent or user running the Skill.
6. The payload may read accessible files, alter local tools, capture configured Alibaba Cloud credentials, or invoke cloud APIs under th ...[truncated 645 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash pipeline entirely.
2. Install through a trusted operating-system package manager where available.
3. Otherwise, download a versioned artifact to a new restricted directory without executing it.
4. Pin an exact CLI version instead of using a mutable setup endpoint.
5. Verify a vendor-published cryptographic signature or SHA-256 digest obtained through an independently trusted channel.
6. Inspect the artifact type and expected contents before extraction or execution.
7. Display the source, version, digest, destination, and required privileges to the user.
8. Obtain explicit approval before installation, especially if system-wide changes are required.
9. Abort if provenance or integrity verification cannot be completed.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:208

Finding

Invalid Unicode Quoting Permits Shell Interpretation of Password Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:208-214
Vulnerability Type: Command injection and unsafe handling of sensitive shell arguments
Risk Level: High

bash

aliyun gpdb create-supabase-project \
  --biz-region-id <BizRegionId> \
  --zone-id <ZoneId> \
  --project-name <ProjectName> \
  --account-password ‘<Password>’ \
  --security-ip-list "127.0.0.1" \
  --vpc-id <VpcId> \

Technical Analysis

The password is surrounded by Unicode curly quotation marks (‘ and ’) rather than ASCII shell quotes. Bash does not recognize these characters as quoting operators. Consequently, a generated or user-provided password rendered into this command is not reliably treated as one literal argument.

The documented password alphabet permits shell-significant characters, including $, &, (, ), #, and *. Depending on how the agent renders and submits the command, those characters can cause expansion, token splitting, syntax changes, or command injection. Even where a control character does not become a separate shell operator, the submitted password can differ from the password shown to the user because shell expansion occurs.

The command also places a plaintext password in a process argument. Process inspection, command logging, shell history, or execution telemetry may expose it.

Attack Path

1. A user supplies, or the workflow generates, a password containing shell metacharacters.
2. The agent substitutes the password into the documented command between Unicode curly quotation marks.
3. The rendered command is submitted to a shell.
4. Bash treats the curly quotation marks as ordinary characters and interprets applicable password characters as shell syntax or expansions.
5. The command may execute unintended syntax, submit modified arguments, or create the project with a password different from the confirmed value.
6. The plaintext password may a ...[truncated 808 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace Unicode punctuation with a safe implementation rather than merely changing the example to ASCII quotes.
2. Construct the command as an argument array so each value is passed directly to the process without shell re-evaluation.
3. Never concatenate user-controlled values into a shell command string or pass the result to eval, bash -c, or an equivalent interpreter.
4. Validate passwords against the documented length and character rules before invocation.
5. Prefer a supported secure-input mechanism, file descriptor, protected temporary file, or standard input if the CLI offers one.
6. If the CLI only supports a command-line flag, disable command tracing, avoid shell history, redact telemetry, and warn that the argument may be visible to same-host process inspection.
7. Add tests using every permitted special character to confirm that the exact password is delivered without expansion or splitting.

T08 · Insecure Dependencies

Error

• Location: references/cli-installation-guide.md:36

Finding

Unverified Mutable Binary Is Installed into a System-Wide Executable Path

Content

View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:36-44
Additional Locations: references/cli-installation-guide.md:53-59, 66-72, 79-85
Vulnerability Type: Unverified dependency installation with elevated privileges
Risk Level: High

bash

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Equivalent Linux and ARM64 instructions also download mutable latest archives, extract them without verification, and move the resulting executable into /usr/local/bin with sudo.

Technical Analysis

The installation guide obtains a mutable latest archive and does not validate a cryptographic digest or signature. It then extracts the archive in the current directory and installs the resulting executable into a system-wide command path using elevated privileges.

Running aliyun version after installation only executes the downloaded program; it does not prove provenance or integrity. A malicious binary can return a plausible version string while retaining arbitrary behavior.

Because the installed executable is subsequently used for authenticated cloud operations, dependency compromise can expose both the host and the configured Alibaba Cloud identity.

Attack Path

1. An attacker replaces or compromises a mutable latest artifact or its publishing infrastructure.
2. The user downloads the artifact using the documented URL.
3. The archive is extracted without checksum, signature, or content validation.
4. sudo mv places the attacker-controlled executable in /usr/local/bin.
5. The executable becomes available system-wide and may take precedence in command resolution.
6. Later Skill operations invoke aliyun, causing the malicious binary to run in a credentialed context.
7. The binary can steal c ...[truncated 692 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every latest URL with an exact, reviewed version.
2. Publish and verify a cryptographic signature or SHA-256 digest before extraction.
3. Download into a newly created directory with restrictive permissions.
4. Validate archive paths and expected contents before extraction.
5. Prefer a trusted package manager whose repository metadata provides integrity verification.
6. Avoid sudo when a user-local installation is sufficient.
7. If system-wide installation is required, show the exact source, version, digest, and destination and obtain separate explicit approval.
8. Verify the installed file owner, mode, path, and digest rather than relying on the binary’s own version output.
9. Document a safe rollback procedure for removing the installed executable.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Mandatory Automatic Plugin Installation and Unpinned Global Updates Expand the Supply-Chain Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:32-34
Vulnerability Type: Automatic retrieval and installation of unpinned dependencies
Risk Level: Medium

bash

> Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> Then **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

Technical Analysis

The Skill mandates automatic plugin installation and updates all existing plugins without specifying exact plugin names, versions, integrity values, or trusted package metadata.

This exceeds the minimum required scope. The declared workflow only needs the components necessary for GPDB and VPC operations, but aliyun plugin update can modify unrelated plugins already present on the machine. Enabling automatic installation also permits future commands to introduce code that was not included in or reviewed with the Skill.

“Always up-to-date” is not a security control: it replaces reviewed components with mutable upstream content and can introduce compromised or incompatible versions immediately before credentialed cloud operations.

Attack Path

1. An attacker compromises a plugin release, registry, update channel, or publisher account.
2. The Skill enables automatic plugin installation.
3. The mandatory update command retrieves the compromised release, potentially including unrelated installed plugins.
4. A subsequent Aliyun command loads or executes the compromised plugin.
5. The plugin observes credentials and parameters, changes cloud requests, returns falsified results, or executes local code.

Impact Assessment

Exploitation can provide code execution in the Aliyun CLI process and access to:

• Aliyun profiles and environment-based credentials.
• Project identifiers, passwords, API keys, and dashboard credentials processed by the workflow.
• Cloud permissions g ...[truncated 174 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not enable automatic plugin installation globally.
2. Identify only the plugins strictly required for the requested operation.
3. Pin each required plugin to an exact reviewed version.
4. Verify package signatures or vendor-published digests before installation.
5. Display plugin names, versions, sources, and expected changes to the user.
6. Require explicit approval before installing or updating executable components.
7. Do not update unrelated existing plugins as part of this Skill.
8. Restore the prior auto-install setting after the workflow if a temporary change is unavoidable.
9. Fail safely when the required verified plugin version is unavailable.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-installation-guide.md:117

Finding

Installation Guide Exposes Long-Lived Access Keys Through Command Arguments and Environment Variables

Content

View full analysis

Vulnerability Details

File Location: references/cli-installation-guide.md:117-124
Additional Location: references/cli-installation-guide.md:140-155
Vulnerability Type: Insecure credential handling and plaintext secret exposure
Risk Level: Medium

bash

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-beijing

The same guide also recommends environment variables and includes a named-profile example:

bash

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-beijing

bash

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-beijing

Technical Analysis

The guide instructs users to place access keys directly in command arguments and shell environment variables. Command-line secrets may be retained in shell history, terminal recordings, CI logs, agent transcripts, process telemetry, or audit systems. Environment variables are inherited by child processes and may be exposed through diagnostics, crash reports, debug tools, or accidental shell-profile commits.

These instructions also conflict with the primary Skill’s security rules, which prohibit asking users to enter AK/SK values directly in the conversation or command line and prohibit configuring literal credentials in-session. Linking to a contradictory guide makes accidental secret exposure likely.

Long-lived Access Key credentials are especially sensitive because they can remain usable until revoked and may authorize all management operations listed by the Skill.

Attack Path

1. A user follows the linked installation guide to configure authentication.
2. The user enters an access key secret directl ...[truncated 1002 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all examples that place real or placeholder secrets in command-line arguments.
2. Align the guide with SKILL.md: credential provisioning must occur outside the agent session.
3. Prefer short-lived STS credentials, OAuth, workload identity, or another temporary identity mechanism over long-lived access keys.
4. Use an operating-system-backed credential store or vendor-supported secure interactive flow.
5. Do not persist secrets in shell profiles or project files.
6. If environment variables are unavoidable, limit their lifetime and scope to a dedicated process, clear them afterward, and prevent inheritance by unrelated child processes.
7. Disable shell tracing and ensure logs and transcripts redact credentials.
8. Document immediate rotation and revocation procedures for suspected exposure.
9. Retain only non-sensitive status checks such as aliyun configure list in the Skill workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs use of curl ... | bash to fetch and execute a remote installation script directly from the network. That pattern bypasses integrity verification and allows server compromise, MITM, or supply-chain tampering to become immediate arbitrary code execution on the operator's machine.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions.
> Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> Then **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The phrase "supabase project" is ambiguous and can overlap with generic Supabase administration or project-management requests outside this skill's intended scope. In a skill that can mutate infrastructure, accidental invocation materially raises the risk of acting on the wrong platform or resource set.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The phrase "supabase project" is ambiguous and can overlap with generic Supabase administration or project-management requests outside this skill's intended scope. In a skill that can mutate infrastructure, accidental invocation materially raises the risk of acting on the wrong platform or resource set.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly allows retrieval and return of API keys and suggests returning them to the user, even if 'minimally'. Exposing live API keys in chat or agent-visible outputs creates a direct secret-disclosure path and can lead to account compromise, especially in shared logs, transcripts, or delegated-agent contexts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

The workflow directs the agent to generate a password and client token and to discover infrastructure details, but does not define strict limits on retention or handling of those sensitive/generated values. In agent environments with memory or transcript persistence, that omission can lead to secrets and infrastructure metadata being retained longer than necessary.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

2. **ProjectName** — Run `scripts/generate-project-name.sh` to get 1-3 candidates (timestamp-based).
3. **Password** — Run `scripts/generate-password.py` to generate a compliant password.
4. **VPC/VSwitch discovery** — Run `scripts/discover-vswitch.sh --biz-region-id <region> --zone-id <zone>` to get the VSwitch with the most available IPs.
5. **SecurityIPList** — Default `127.0.0.1`.
6. **Optional flags** — Use defaults: `2C2G`, `20` GB, `POSTPAY`, `PL0`.
7. **ClientToken** — Generate one UUID.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The creation workflow instructs the agent to display a generated password to the user as part of the plan. Showing newly generated credentials in conversation risks disclosure through chat history, logs, screenshots, or model context retention, turning an administrative convenience into a secret-handling vulnerability.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 44)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 59)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 72)May include surrounding context.

md

tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 85)May include surrounding context.

Extract and install

tar -xzf aliyun-cli-linux-latest-arm64.tgz sudo mv aliyun /usr/local/bin/

text

### Windows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly instructs users to configure long-lived Access Key credentials via CLI flags and environment variables, and even includes example-looking key material in profile commands. In the context of an operational skill for managing Supabase/ADBPG resources, this increases the chance of secret exposure through shell history, process listings, CI logs, copied docs, or accidental commits, which could lead to unauthorized cloud access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

| ProjectName | `--project-name` | Yes | Derive from scenario (see below) | Yes |
| ZoneId | `--zone-id` | Yes | `cn-beijing-i` (skill default) | Yes |
| AccountPassword | `--account-password` | Yes | Generate if user omits (see below) | Yes |
| SecurityIPList | `--security-ip-list` | Yes | `127.0.0.1` (no external access until changed) | Yes |
| VpcId | `--vpc-id` | Yes | From discovery if omitted (see below) | Yes |
| VSwitchId | `--vswitch-id` | Yes | From discovery if omitted (see below) | Yes |
| ProjectSpec | `--project-spec` | Yes | **`2C2G`** (skill default recommendation; API doc minimum default is `1C1G`) | Yes |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 92)May include surrounding context.

md

| ProjectName | `--project-name` | Yes | Derive from scenario (see below) | Yes |
| ZoneId | `--zone-id` | Yes | `cn-beijing-i` (skill default) | Yes |
| AccountPassword | `--account-password` | Yes | Generate if user omits (see below) | Yes |
| SecurityIPList | `--security-ip-list` | Yes | `127.0.0.1` (no external access until changed) | Yes |
| VpcId | `--vpc-id` | Yes | From discovery if omitted (see below) | Yes |
| VSwitchId | `--vswitch-id` | Yes | From discovery if omitted (see below) | Yes |
| ProjectSpec | `--project-spec` | Yes | **`2C2G`** (skill default recommendation; API doc minimum default is `1C1G`) | Yes |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/create-supabase-project-parameters.md (reported line 19)May include surrounding context.

md

| ProjectName | `--project-name` | Yes | Derive from scenario (see below) | Yes |
| ZoneId | `--zone-id` | Yes | `cn-beijing-i` (skill default) | Yes |
| AccountPassword | `--account-password` | Yes | Generate if user omits (see below) | Yes |
| SecurityIPList | `--security-ip-list` | Yes | `127.0.0.1` (no external access until changed) | Yes |
| VpcId | `--vpc-id` | Yes | From discovery if omitted (see below) | Yes |
| VSwitchId | `--vswitch-id` | Yes | From discovery if omitted (see below) | Yes |
| ProjectSpec | `--project-spec` | Yes | **`2C2G`** (skill default recommendation; API doc minimum default is `1C1G`) | Yes |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/create-supabase-project-parameters.md (reported line 46)May include surrounding context.

md

| ProjectName | `--project-name` | Yes | Derive from scenario (see below) | Yes |
| ZoneId | `--zone-id` | Yes | `cn-beijing-i` (skill default) | Yes |
| AccountPassword | `--account-password` | Yes | Generate if user omits (see below) | Yes |
| SecurityIPList | `--security-ip-list` | Yes | `127.0.0.1` (no external access until changed) | Yes |
| VpcId | `--vpc-id` | Yes | From discovery if omitted (see below) | Yes |
| VSwitchId | `--vswitch-id` | Yes | From discovery if omitted (see below) | Yes |
| ProjectSpec | `--project-spec` | Yes | **`2C2G`** (skill default recommendation; API doc minimum default is `1C1G`) | Yes |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/verification-method.md (reported line 160)May include surrounding context.

md

| ProjectName | `--project-name` | Yes | Derive from scenario (see below) | Yes |
| ZoneId | `--zone-id` | Yes | `cn-beijing-i` (skill default) | Yes |
| AccountPassword | `--account-password` | Yes | Generate if user omits (see below) | Yes |
| SecurityIPList | `--security-ip-list` | Yes | `127.0.0.1` (no external access until changed) | Yes |
| VpcId | `--vpc-id` | Yes | From discovery if omitted (see below) | Yes |
| VSwitchId | `--vswitch-id` | Yes | From discovery if omitted (see below) | Yes |
| ProjectSpec | `--project-spec` | Yes | **`2C2G`** (skill default recommendation; API doc minimum default is `1C1G`) | Yes |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The policy documentation explicitly grants access to API keys via gpdb:GetSupabaseProjectApiKeys but does not warn that this permission exposes sensitive credentials that can enable unauthorized access if mishandled. In an operations skill that manages live Supabase projects, normalizing this permission as low-friction read access increases the chance of overbroad grants and secret disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The documentation includes gpdb:GetSupabaseProjectDashboardAccount without noting that dashboard account details may expose sensitive identity or administrative access information. Because this skill is designed for full lifecycle management, presenting that access alongside ordinary read operations can lead users to overgrant privileges and leak operationally sensitive account data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly advertises commands that retrieve Supabase API keys and dashboard account information, but provides no warning, access-control guidance, masking expectations, or handling requirements for these secrets. In an agent skill context, this increases the chance the agent will fetch and disclose credentials into chat output, logs, or downstream tools, enabling unauthorized access to the project.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file describes querying API keys such as AnonKey and ServiceRoleKey without any warning about secret sensitivity or restrictions on display, logging, or storage. In particular, ServiceRoleKey is typically privileged and exposing it through an agent workflow can directly enable unauthorized access or abuse of the Supabase project.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs retrieval of dashboard account information including credentials, which is highly sensitive operational data. In an agent skill, documenting credential retrieval without strict scope limitation and handling guidance can normalize secret extraction and enable unnecessary exposure of privileged access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation states that dashboard account query returns login URL and credentials, but provides no warning that these are sensitive authentication secrets. This creates a realistic risk that an agent will surface, persist, or mishandle administrator login material during routine verification flows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow says to act when the user provides intent like a Chinese phrase, but the document does not state that Chinese is optional or that users may interact in another language. Under the locale policy, forcing or implying a specific language without opt-in can be a policy concern unless the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.