Security audit

Volcengine Db Supabase

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a legitimate Volcengine Supabase administration skill, but it needs review because some paths can change live backend state or weaken authentication without strong guardrails.

Review before installing. Use only with Volcengine accounts and workspaces you want the agent to administer, prefer temporary or least-privilege credentials, and avoid shared machines with persistent CLI profiles. Do not use --no-verify-jwt unless the function implements its own authentication or webhook signature checks. Treat --show-values, API keys, service-role keys, raw SQL, delete, stop, and deployment commands as sensitive actions requiring explicit user intent and verification on a non-production branch first.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The `list-migrations` action is presented as a read/list operation, but it issues `CREATE SCHEMA IF NOT EXISTS` and `CREATE TABLE IF NOT EXISTS` before reading. In an agent context, that violates the expected read-only contract and can cause unauthorized state changes even when a user only asked to inspect metadata.

Description-Behavior Mismatch

Low

Confidence: 80% confidence
Finding: `get-edge-function` normalizes the API response and returns embedded file contents as `source_code`, which can expose proprietary logic, secrets accidentally hardcoded in functions, or internal implementation details. In a management skill, returning full code is more sensitive than returning metadata and increases the blast radius of an over-broad retrieval request.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document explicitly advertises `pages env-vars --show-values` to reveal plaintext environment variable values but does not warn that this may expose secrets such as API keys, tokens, or database credentials in logs, transcripts, screenshots, or model outputs. In an agent skill context, this is risky because the agent may surface secret values back to users or persist them in execution history without necessity.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This script exposes destructive and state-changing actions such as applying migrations, deploying/deleting edge functions, and creating/deleting storage buckets without any built-in confirmation, dry-run, or explicit acknowledgment mechanism. In an agent-driven environment, prompt mistakes or malicious prompt steering can therefore directly alter or destroy backend resources.

Session Persistence

Medium

Category: Rogue Agent
Content: services (RDS MySQL, Redis), or pure client-side coding unrelated to Supabase backend management. version: 2.3.3 user-invocable: true allowed-tools: Bash, Read, Write license: MIT metadata: openclaw:
Confidence: 78% confidence
Finding: Write license: MIT metadata: openclaw: emoji: "🧩" homepage: "https://www.volcengine.com/" requires: bins: - byted-supabase-cli install: - kind: node packa

Tool Parameter Abuse

High

Category: Tool Misuse
Content: |------|------| | 列出函数 | `functions list --workspace-id ws-...` | | 新建函数（本地脚手架） | `functions new <name>` → 编辑 `supabase/functions/<name>/index.ts` | | 部署函数 | `functions deploy <name> --workspace-id ws-...`（公开访问加 `--no-verify-jwt`） | | 下载 / 删除函数 | `functions download <name>` ／ `functions delete <name>` | > 部署从**本地函数目录**进行（`functions new` → 编辑 → `functions deploy`），不再支持单文件/内联代码。编写规范见 [`references/edge-function-dev-guide.md`](references/edge-function-dev-guide.md)。
Confidence: 90% confidence
Finding: --no-verify

Tool Parameter Abuse

High

Category: Tool Misuse
Content: byted-supabase-cli functions deploy my-api --workspace-id ws-xxxx # 部署时禁用 JWT 验证（公开 API，如 Webhook） byted-supabase-cli functions deploy public-api --workspace-id ws-xxxx --no-verify-jwt # 指定运行时（默认 auto；可选 deno / native-node20/v1 / python3.9|3.10|3.12） byted-supabase-cli functions deploy my-api --workspace-id ws-xxxx --runtime deno
Confidence: 94% confidence
Finding: --no-verify

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ## 注意事项 - **JWT 验证**：默认启用。如果函数需要公开访问（如 Webhook），使用 `--no-verify-jwt` - **函数命名**：只能使用小写字母、数字和连字符（如 `my-api`、`process-order`） - **超时**：Edge Function 有执行时间限制，避免长时间阻塞操作 - **日志**：使用 `console.log()` 记录日志，可在平台控制台查看
Confidence: 93% confidence
Finding: --no-verify

Tool Parameter Abuse

High

Category: Tool Misuse
Content: |---|---| | `list-edge-functions` | `byted-supabase-cli functions list --workspace-id ws-... -o json` | | `get-edge-function` | `byted-supabase-cli functions download <name> --workspace-id ws-...`（拉取源码到本地） | | `deploy-edge-function --source-file index.ts` | `byted-supabase-cli functions new <name>` → 编辑 `supabase/functions/<name>/index.ts` → `byted-supabase-cli functions deploy <name> --workspace-id ws-... [--no-verify-jwt]` | | `delete-edge-function` | `byted-supabase-cli functions delete <name> --workspace-id ws-...` | `functions deploy` 关键参数：`--no-verify-jwt`（公开访问，如 Webhook）、`--runtime auto|deno|native-node20/v1|python3.9|python3.10|python3.12`、`--import-map <path>`。
Confidence: 93% confidence
Finding: --no-verify

Tool Parameter Abuse

High

Category: Tool Misuse
Content: | `deploy-edge-function --source-file index.ts` | `byted-supabase-cli functions new <name>` → 编辑 `supabase/functions/<name>/index.ts` → `byted-supabase-cli functions deploy <name> --workspace-id ws-... [--no-verify-jwt]` | | `delete-edge-function` | `byted-supabase-cli functions delete <name> --workspace-id ws-...` | `functions deploy` 关键参数：`--no-verify-jwt`（公开访问，如 Webhook）、`--runtime auto|deno|native-node20/v1|python3.9|python3.10|python3.12`、`--import-map <path>`。 ---
Confidence: 92% confidence
Finding: --no-verify

Tool Parameter Abuse

High

Category: Tool Misuse
Content: parser.add_argument("--source-code") parser.add_argument("--source-file") parser.add_argument("--verify-jwt", dest="verify_jwt", action="store_true", default=True) parser.add_argument("--no-verify-jwt", dest="verify_jwt", action="store_false") parser.add_argument("--runtime", default="native-node20/v1") parser.add_argument("--import-map") parser.add_argument("--import-map-file")
Confidence: 87% confidence
Finding: --no-verify

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/app-integration-guide.md:54