Next-Supabase-Vercel Bundle

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:20 PM UTC
• Version: 1.0.0

Overview

This appears to be a real Next.js/Supabase/Vercel helper, but it handles powerful project setup, deployment, SQL, and credentials too loosely for automatic trust.

Review before installing or running. Use it only in a disposable or constrained project environment, avoid passing untrusted project names, ports, migration names, or bucket names, inspect generated SQL before running it in Supabase, and do not add a real Supabase service-role key unless a specific server-only operation requires it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: src/commands/init.js:20

Finding

OS Command Injection Through the Project Name

Content

View full analysis

Vulnerability Details

File Location: src/commands/init.js:20-83
Vulnerability Type: OS command injection through shell interpolation
Risk Level: High

Vulnerable Code

javascript

// Validate project name
if (!projectName || projectName.length === 0) {
  spinner.fail('Project name is required');
  process.exit(1);
}

// Create project with create-next-app
const createNextAppCommand = [
  'npx',
  'create-next-app@latest',
  projectName,
  '--typescript',
  '--tailwind',
  '--eslint',
  '--app',
  '--src-dir',
  '--import-alias "@/*"',
  '--use-npm'
].filter(Boolean);

execSync(createNextAppCommand.join(' '), { stdio: 'inherit' });

const projectPath = path.join(process.cwd(), projectName);

// Install Supabase dependencies
const installCommand = `cd ${projectPath} && npm install @supabase/supabase-js @supabase/ssr`;
execSync(installCommand, { stdio: 'inherit' });

// Initialize git
execSync(`cd ${projectPath} && git init`, { stdio: 'ignore' });

Technical Analysis

The positional projectName argument is controlled by the CLI caller. Validation only checks whether the value is empty; it does not restrict shell metacharacters or enforce a valid npm package-name format.

The value is subsequently:

1. Joined into a shell command passed to execSync().
2. Included in projectPath.
3. Interpolated into two additional shell commands.

By default, execSync() executes command strings through a system shell. Characters such as command separators, redirection operators, and command substitutions can therefore alter the intended command. The vulnerability is not limited to creation of an unexpected directory: injected shell commands execute with the privileges of the user running snv.

Attack Path

1. An attacker convinces a user or automation system to initialize a project using a crafted project-name argument.
2. The CLI verifies on ...[truncated 855 chars]

Remediation

View remediation

Remediation Suggestions

• Replace shell command strings with spawnSync() or execFileSync() and explicit argument arrays.
• Ensure shell interpretation is disabled.
• Validate project names against a strict npm/Next.js-compatible allowlist, rejecting whitespace, path separators, shell metacharacters, and traversal sequences.
• Use the cwd process option rather than constructing cd path && command strings.
• Verify that the resolved project path remains inside the intended parent directory.

A safer implementation pattern is:

javascript

const { spawnSync } = require('child_process');

if (!/^[a-z0-9][a-z0-9._-]*$/.test(projectName)) {
  throw new Error('Invalid project name');
}

spawnSync(
  'npx',
  [
    'create-next-app@reviewed-version',
    projectName,
    '--typescript',
    '--tailwind',
    '--eslint',
    '--app',
    '--src-dir',
    '--import-alias',
    '@/*',
    '--use-npm'
  ],
  { stdio: 'inherit', shell: false }
);

spawnSync(
  'npm',
  ['install', '@supabase/supabase-js', '@supabase/ssr'],
  { cwd: projectPath, stdio: 'inherit', shell: false }
);

spawnSync('git', ['init'], {
  cwd: projectPath,
  stdio: 'ignore',
  shell: false
});

T09 · Insecure Skill Coding Practices

Error

• Location: src/commands/dev.js:9

Finding

OS Command Injection Through the Development Server Port

Content

View full analysis

Vulnerability Details

File Location: src/commands/dev.js:9-25
Vulnerability Type: OS command injection through an unvalidated option
Risk Level: High

Vulnerable Code

javascript

const devCommand = new Command('dev')
  .description('Start local development server')
  .option('-p, --port <number>', 'Port to run on', '3000')
  .action(async (options) => {
    const spinner = ora('Starting development server...').start();

    try {
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found. Please set your Supabase credentials first.'));
        console.log(chalk.yellow('\nRun: snv db:setup\n'));
        process.exit(1);
      }

      spinner.text = 'Starting Next.js dev server...';
      execSync(`npm run dev -- --port ${options.port}`, { stdio: 'inherit' });
    } catch (error) {
      spinner.fail(chalk.red(`Error starting dev server: ${error.message}`));
      process.exit(1);
    }
  });

Technical Analysis

Commander treats the port option as a string because no parser function is provided. The option description labels it as a number, but the implementation neither converts it to an integer nor verifies its range.

The untrusted string is directly interpolated into a command passed to execSync(). The shell consequently interprets any metacharacters in the supplied port value rather than treating the entire value as a single Next.js argument.

The .env.local existence check does not mitigate the issue. Any project directory containing that file reaches the vulnerable execution sink.

Attack Path

1. An attacker supplies or causes a user to execute snv dev with a crafted --port value.
2. Commander stores the supplied value as an arbitrary string.
3. The CLI confirms that .env.local exists.
4. The unvalidated value is interpolated into the n ...[truncated 466 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the port with a strict Commander parser or Number.parseInt().
• Reject non-integer values and values outside the range 1-65535.
• Invoke npm with an argument array and without a shell.
• Do not rely on quoting or ad hoc escaping when an argument-based process API is available.

Example:

javascript

.option('-p, --port <number>', 'Port to run on', value => {
  if (!/^\d+$/.test(value)) {
    throw new Error('Port must be an integer');
  }

  const port = Number(value);
  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
    throw new Error('Port must be between 1 and 65535');
  }

  return port;
}, 3000);

spawnSync(
  'npm',
  ['run', 'dev', '--', '--port', String(options.port)],
  { stdio: 'inherit', shell: false }
);

T09 · Insecure Skill Coding Practices

Error

• Location: src/commands/storage.js:9

Finding

SQL Injection in Generated Supabase Storage Policy

Content

View full analysis

Vulnerability Details

File Location: src/commands/storage.js:9-63
Vulnerability Type: SQL injection through unsafe SQL generation
Risk Level: High

Vulnerable Code

javascript

const storageCommand = new Command('storage:setup')
  .description('Configure Supabase Storage buckets')
  .option('-b, --buckets <names>', 'Bucket names (comma-separated)')
  .action(async (options) => {
    const spinner = ora('Setting up storage...').start();

    try {
      let bucketNames = options.buckets;
      if (!bucketNames) {
        const answer = await inquirer.prompt([
          {
            type: 'input',
            name: 'buckets',
            message: 'Enter bucket names (comma-separated):',
            default: 'avatars,documents',
            validate: (input) => {
              if (!input || input.trim().length === 0) {
                return 'Please enter at least one bucket name';
              }
              return true;
            }
          }
        ]);
        bucketNames = answer.buckets;
      }

      console.log(chalk.gray(`create policy "Public read"
on storage.objects for select
using (
  bucket_id
)
with check (
  bucket_id in ('${bucketNames.split(',').map(b => b.trim()).join('\', \'')}\'')
)
grant select;
\n`));

      console.log(chalk.gray('Copy and run this in Supabase SQL Editor\n'));
    } catch (error) {
      spinner.fail(chalk.red(`Error setting up storage: ${error.message}`));
      process.exit(1);
    }
  });

Technical Analysis

Bucket names are embedded directly into SQL string literals. Interactive validation only checks that the input is non-empty, while values supplied through --buckets receive no validation at all.

A bucket value containing a single quote can terminate the intended SQL literal. Additional SQL can then be appended to the generated output. The CLI explicitly tells the us ...[truncated 1464 chars]

Remediation

View remediation

Remediation Suggestions

• Validate every individual bucket name against a strict allowlist such as ^[a-z0-9][a-z0-9_-]{0,62}$.
• Reject quotes, whitespace, comments, semicolons, control characters, and empty list entries.
• Use a trusted PostgreSQL literal-escaping function instead of manual string concatenation.
• Generate a valid select policy using a Boolean predicate such as USING (bucket_id IN (...)).
• Remove WITH CHECK from select-only policies.
• Default to private buckets and require explicit confirmation before generating public-read access.
• Display the precise security consequences before asking users to execute policy SQL.
• Prefer applying reviewed, static migration templates rather than constructing privileged SQL from free-form input.

T08 · Insecure Dependencies

Warning

• Location: src/commands/init.js:42

Finding

Mutable and Unpinned Remote Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: src/commands/init.js:42-79; package.json:39-50; SKILL.md:541-544
Vulnerability Type: Unsafe dependency resolution and remote package execution
Risk Level: Medium

Vulnerable Code

javascript

const createNextAppCommand = [
  'npx',
  'create-next-app@latest',
  projectName,
  '--typescript',
  '--tailwind',
  '--eslint',
  '--app',
  '--src-dir',
  '--import-alias "@/*"',
  '--use-npm'
].filter(Boolean);

execSync(createNextAppCommand.join(' '), { stdio: 'inherit' });

const installCommand = `cd ${projectPath} && npm install @supabase/supabase-js @supabase/ssr`;
execSync(installCommand, { stdio: 'inherit' });

json

{
  "dependencies": {
    "chalk": "^4.1.2",
    "ora": "^5.4.1",
    "fs-extra": "^11.2.0",
    "@supabase/supabase-js": "^2.0.0",
    "next": "^14.0.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",
    "typescript": "^5.0.0"
  }
}

bash

npm install -g vercel

Technical Analysis

The initialization command invokes create-next-app@latest, causing npx to resolve and execute whichever release is tagged as latest at execution time. The effective code can therefore change after this Skill has been reviewed.

Additional packages are installed without exact versions, and the Skill package uses broad caret ranges. No lockfile was present in the audited project. npm package installation can also execute package lifecycle scripts under the invoking user's account.

The observed package names are recognizable ecosystem packages rather than evident typosquatting names. The risk arises from mutable resolution, lack of reproducibility, and automatic execution rather than proof that the current upstream packages are malicious.

Attack Path

1. A user runs the initialization command or follows the Vercel installation instructions.
2. npm resolves mutable tags or ...[truncated 832 chars]

Remediation

View remediation

Remediation Suggestions

• Replace create-next-app@latest with an exact, reviewed version.
• Pin all direct dependencies to exact versions rather than broad caret ranges.
• Commit a lockfile and use npm ci for reproducible installation.
• Pin the Vercel CLI version in documentation and automation.
• Review transitive dependency changes before updating the lockfile.
• Use npm provenance and integrity controls where available.
• Consider suppressing lifecycle scripts with --ignore-scripts when they are not required.
• If lifecycle scripts are necessary, document them and review the packages that execute them.
• Run scaffolding and dependency installation in a constrained environment without unrelated secrets.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: src/commands/init.js:112

Finding

Unnecessary Provisioning of a Supabase Service-Role Key

Content

View full analysis

Vulnerability Details

File Location: src/commands/init.js:112-124 and src/commands/init.js:149-158; deployment guidance at SKILL.md:391-395
Vulnerability Type: Excessive privilege and unnecessary secret exposure
Risk Level: Medium

Vulnerable Code

javascript

async function createEnvTemplate(projectPath) {
  const envTemplate = `# Supabase Configuration
# Get these from: https://supabase.com/dashboard/project/_/settings/api

NEXT_PUBLIC_SUPABASE_URL=your_project_url_here
NEXT_PUBLIC_SUPABASE_ANON_KEY=your_anon_key_here

# Optional - Service role key for server-side operations
SUPABASE_SERVICE_KEY=your_service_role_key_here
`;

  await fs.writeFile(path.join(projectPath, '.env.local'), envTemplate);
  await fs.writeFile(path.join(projectPath, '.env.example'), envTemplate);
}

javascript

// Server-side client with service role key
export const supabaseServer = () => {
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL
  const supabaseServiceKey = process.env.SUPABASE_SERVICE_KEY

  if (!supabaseServiceKey) {
    throw new Error('SUPABASE_SERVICE_KEY is required for server operations')
  }

  return createClient(supabaseUrl, supabaseServiceKey)
}

The deployment documentation also lists the service-role key among variables to configure in Vercel:

text

Variables required:
  NEXT_PUBLIC_SUPABASE_URL
  NEXT_PUBLIC_SUPABASE_ANON_KEY
  SUPABASE_SERVICE_KEY

Technical Analysis

Supabase service-role keys are highly privileged and normally bypass Row Level Security. The Skill places a service-role placeholder in every generated local environment, creates a general-purpose client capable of using it, and directs users to provision the key in a production deployment.

The implemented db:setup command does not require this privilege. It reads and uses NEXT_PUBLIC_SUPABASE_ANON_KEY for its connection test. No concrete generated applicat ...[truncated 1290 chars]

Remediation

View remediation

Remediation Suggestions

• Remove SUPABASE_SERVICE_KEY from the default environment template.
• Remove it from generic deployment instructions.
• Use the anonymous key for the implemented connection test and ordinary RLS-protected operations.
• Introduce service-role access only when a specific trusted server-side operation requires it.
• Place privileged client construction in a clearly server-only module and prevent client imports.
• Add framework protections such as server-only imports where appropriate.
• Never copy real secrets into .env.example.
• Ensure .env.local is excluded from version control and set restrictive filesystem permissions where supported.
• Rotate the service-role key immediately if it is exposed.
• Prefer narrowly scoped backend functions or dedicated credentials over distributing a broad RLS-bypassing key.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad orchestration tool for the complete full-stack development lifecycle, including Supabase connectivity, executable SQL migration generation, guided workflow, and Vercel deployment integration. The supplied code chunk does something much narrower: it defines a CLI command that checks for an existing auth directory and writes local authentication-related files (src/app/auth/login/page.tsx, src/app/auth/signup/page.tsx, and lib/auth.ts). Its primary purpose is scaffolding authentication pages and utility wrappers around Supabase auth methods. There is no code here for database migrations, no actual connection or provisioning against a Supabase project, no Vercel API usage or deployment automation, and no orchestration logic for a broader development lifecycle. Therefore the code materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description significantly overstates the skill's scope and capabilities. The code is narrowly focused on Supabase database setup and migration file scaffolding. It reads local environment variables, performs a simple connection test, checks for migration files, prompts the user, and instructs them to run SQL manually in the Supabase dashboard. It also creates boilerplate migration files. There is no evidence of Vercel integration, deployment automation, or broader full-stack orchestration. The primary purpose in the code is database-related CLI assistance, not a complete development-cycle orchestrator.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code chunk is specifically a Vercel deployment command. It verifies the Vercel CLI, optionally links the project, runs npm run build, deploys with vercel deploy, and inspects .env.local for Supabase-related variable names. It does not connect to Supabase, generate migrations SQL, manage a full-stack development lifecycle, or provide step-by-step orchestration. While the declared description mentions Vercel integration, the rest of the claimed capabilities are not represented in this code, and the actual primary purpose is materially narrower and different.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a broad orchestration tool for the full development lifecycle, including Supabase connectivity, migration generation, and Vercel deployment integration. The supplied code only defines a dev command that verifies the existence of .env.local and invokes the local Next.js development server on a specified port. This is a materially different and much narrower purpose than declared, so the description does not accurately represent the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description overstates the skill's functionality. The code only defines an init command for bootstrapping a local Next.js + Supabase project skeleton. It runs create-next-app, creates env/example files, writes a Supabase client helper, creates a migrations directory, copies template files, installs dependencies, and initializes git. There is no code that authenticates to or communicates with Supabase services, no migration authoring/execution logic, and no Vercel API/CLI usage for deployment. Therefore the declared purpose does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad orchestration tool for full-stack development with Supabase connectivity, executable SQL migration generation, guided workflow, and Vercel deployment integration. The supplied code does none of that. It is a narrow interactive CLI helper for storage setup: it collects bucket names, instructs the user to perform manual steps in the Supabase dashboard, and prints an example RLS policy. There is no evidence of Supabase API access, migration execution, deployment integration, or end-to-end orchestration. This is a material mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a broad orchestration tool covering the full development lifecycle, Supabase connectivity, executable migration generation, guided workflow, and Vercel deployment automation. The supplied code chunk does none of those core functions. It only inspects local files to determine whether the project uses Next.js, whether Supabase-related environment variables are present, extracts those values, validates basic setup, and prints status messages. While these checks are loosely related to a Next.js/Supabase setup, they are only small support utilities and materially fall short of the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The provided code is a small utility for creating and exporting a Supabase client using environment variables. While this is loosely related to the declared Supabase connection claim, it does not implement the skill's stated primary purpose of orchestrating the full development cycle, generating executable SQL migrations, guiding the user through steps, or integrating with Vercel for automatic deployment. The actual behavior is substantially narrower than the declared description, so this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

5. Crea `package.json` con dependencias pre-configuradas

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · snv.js (reported line 21)May include surrounding context.

js

.name('snv')
  .description('Next-Supabase-Vercel Bundle - Complete automation for the modern full-stack development cycle')
  .version('1.0.0')
  .option('--debug', 'Enable debug mode', false);

// Add commands
program.addCommand(initCommand);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

const spinner = ora('Setting up database...').start();

    try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 417)May include surrounding context.

md

const spinner = ora('Setting up database...').start();

    try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 528)May include surrounding context.

md

const spinner = ora('Setting up database...').start();

    try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 565)May include surrounding context.

md

const spinner = ora('Setting up database...').start();

    try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/db.js (reported line 14)May include surrounding context.

js

const spinner = ora('Setting up database...').start();

    try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/db.js (reported line 17)May include surrounding context.

js

const spinner = ora('Setting up database...').start();

    try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/db.js (reported line 18)May include surrounding context.

js

const spinner = ora('Setting up database...').start();

    try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/deploy.js (reported line 71)May include surrounding context.

js

const spinner = ora('Setting up database...').start();

    try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/dev.js (reported line 15)May include surrounding context.

js

const spinner = ora('Setting up database...').start();

    try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/dev.js (reported line 18)May include surrounding context.

js

const spinner = ora('Setting up database...').start();

    try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/utils/helpers.js (reported line 31)May include surrounding context.

js

const spinner = ora('Setting up database...').start();

    try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/db.js (reported line 15)May include surrounding context.

js

try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));
        console.log(chalk.yellow('\nPlease set your Supabase credentials in .env.local first.'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/db.js (reported line 37)May include surrounding context.

js

try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));
        console.log(chalk.yellow('\nPlease set your Supabase credentials in .env.local first.'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/deploy.js (reported line 67)May include surrounding context.

js

try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));
        console.log(chalk.yellow('\nPlease set your Supabase credentials in .env.local first.'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/deploy.js (reported line 82)May include surrounding context.

js

try {
      // Verify .env.local exists
      const envPath = path.join(process.cwd(), '.env.local');
      if (!await fs.pathExists(envPath)) {
        spinner.fail(chalk.red('.env.local not found'));
        console.log(chalk.yellow('\nPlease set your Supabase credentials in .env.local first.'));

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/commands/deploy.js:18

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/commands/dev.js:25

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/commands/init.js:56