Supabase Tool

Generate Supabase API curl commands and SQL query helpers. Use when querying tables, counting rows, inserting records, checking database health, auditing RLS...

This skill appears coherent and low-risk: it only generates example curl commands and does not store or read secrets. Before using: (1) note the script requires bash, curl, and python3 even though the registry metadata omitted those; (2) carefully replace placeholders (YOUR_ACCESS_TOKEN, YOUR_ANON_KEY, YOUR_PROJECT_REF) locally — do not paste secrets into public chat; (3) inspect any generated curl command before running it to ensure you aren't sending sensitive data to an unexpected place. If you want extra assurance, run the printed curl commands from a local terminal rather than allowing any automated executor to run them for you.

Type: OpenClaw Skill Name: supabase-tool Version: 1.1.0 The skill is a Supabase command generator, but `scripts/script.sh` contains a shell injection vulnerability. The functions `cmd_query`, `cmd_select`, `cmd_count`, and `cmd_insert` use unquoted heredocs (`cat << EOF`) to interpolate user-provided arguments into the output. This allows for arbitrary command execution on the host if the input contains shell substitutions (e.g., `$(command)`). While the tool's logic appears intended for legitimate database management and lacks evidence of intentional malice or data exfiltration, the insecure handling of shell input makes it high-risk for exploitation.