Supabase DB

Connect to Supabase for SQL queries, CRUD, table management, and vector similarity search using pgvector extension and OpenAI embeddings.

This skill appears to implement the Supabase functionality it claims, but proceed cautiously: 1) It requires a Supabase service-role key (SUPABASE_SERVICE_KEY) that can read/modify all data and bypasses RLS — only provide a service key if you trust the skill and consider using a least-privilege/project-scoped key instead. 2) Vector search requires an OpenAI API key; the script will send your query text to OpenAI and use the returned embedding. 3) The package metadata does not list these env vars or required tools (curl, jq); check you trust the source and inspect scripts before installing. 4) If you install, run the skill in an isolated environment or with rotated/limited keys first, and avoid giving permanent high-privilege credentials to untrusted skills.

Type: OpenClaw Skill Name: supabase-db Version: 1.2.1 The skill provides high-risk database capabilities, including raw SQL execution via the `query` command and the use of the Supabase Service Role Key, which explicitly bypasses Row Level Security (RLS). While these features are aligned with the stated purpose of a database management tool, they represent significant security risks in an AI agent context. The implementation in `scripts/supabase.sh` and instructions in `SKILL.md` appear functional and lack clear evidence of intentional malice, though the future-dated metadata and migration notices (March 2026) in `_meta.json` and `SKILL.md` are unusual.