Security audit
Security checks for vulnerabilities and agentic risk
This is a plain Markdown Lovable development helper; it describes expected app-building, Supabase, GitHub, and deployment workflows without bundled code or hidden execution.
Before using generated Supabase, GitHub, or deployment output, review database policies, auth settings, storage rules, repository visibility, secrets, and hosting targets. The skill itself appears informational and purpose-aligned, but those connected services can expose data or code if configured carelessly.
The skill promotes automatic creation of database tables, RLS policies, authentication, and file upload features without telling users to review security-sensitive backend changes. This is dangerous because autogenerated backend configuration can introduce overly permissive access controls, insecure auth flows, or unsafe storage exposure that users may trust without verification.
The skill advertises automatic GitHub syncing and one-click deployment, including publishing to hosted domains, but provides no warning that source code may be transferred to third-party services or publicly deployed. In an agent context, this can cause unintended code exposure, accidental publication of sensitive content, or unauthorized external actions if users do not realize these operations leave the local environment.
No suspicious patterns detected.
