T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:52- Finding
Shell Command Injection Through Unsanitized Supabase Request Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
Supabase Manager
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real Supabase helper, but it needs review because it can change remote database data through broad, under-validated shell commands and has unclear local credential/config guidance.
Install only if you are comfortable with an agent using your Supabase anon key to read and modify project data through RLS. Confirm the exact Supabase URL before use, never provide a service-role key, treat INSERT and RPC as state-changing operations that should get explicit approval, and avoid storing keys locally unless a secure credential store is used.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger list includes broad terms like 'database', 'insert into', and 'delete from', which can cause the skill to activate in unrelated contexts and handle sensitive data or perform unintended operations. In a skill capable of querying and mutating remote data stores, over-broad invocation materially raises the risk of accidental external actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Query (SELECT)
bash curl -s "[URL]/rest/v1/[table]?select=*&[filters]" \ -H "apikey: [KEY]" \ -H "Authorization: Bearer [KEY]"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill provides direct insert and RPC guidance without parallel, explicit safety language requiring user confirmation and disclosure that data will be transmitted to an external service. While DELETE and UPDATE are later called out for confirmation, INSERT and RPC can also change state or invoke sensitive server-side behavior and should be guarded similarly.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
"Count [table]"
bash curl -s "[URL]/rest/v1/[table]?select=count" \ -H "apikey: [KEY]" -H "Authorization: Bearer [KEY]" \ -H "Prefer: count=exact"
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill explicitly says credentials are provided at runtime and not stored, but later instructs to store config locally, which can reasonably include the Supabase URL and anon key. Even though the anon key is lower sensitivity than a service-role key, persisting credentials locally increases the chance of accidental disclosure through shell history, dotfiles, backups, or multi-user systems.
- Content