Supabase Hakke

Supabase integration for Hakke Studio projects. Auth, database, storage, edge functions. Use with vercel skill for full-stack deployment.

This skill appears to be a legitimate Supabase how‑to for the author's Hakke project, but it contains author-specific paths and an explicit OAuth login email and references server-side secrets without declaring them. Before installing or running it: 1) do not provide any credentials unless you understand which key is needed (server_role keys are highly sensitive and should only be used in secure server environments); 2) remove or adapt hard-coded local paths and the example login email to your own environment; 3) treat the SKILL.md as documentation rather than an automated routine — running the 'supabase login' and CLI commands from the agent could attempt to use or modify your local files and environment; and 4) if you plan to allow the agent to invoke this skill autonomously, restrict it from accessing secrets or running CLI commands until you have sanitized the instructions. If you want a safer integration, ask the author to provide a cleaned, generalized SKILL.md that declares required env vars explicitly and removes author-specific artifacts.

Type: OpenClaw Skill Name: supabase-hakke Version: 1.1.0 The skill is classified as suspicious due to its explicit declaration of the `exec` tool, allowing it to execute arbitrary shell commands. While the commands themselves appear to be standard Supabase and Vercel CLI operations (e.g., `supabase login`, `supabase db push`, `vercel env add`), the capability to execute shell commands and handle sensitive environment variables (like `SUPABASE_SERVICE_ROLE_KEY`) inherently carries a high risk. There is no direct evidence of malicious intent, such as data exfiltration to unauthorized endpoints or instructions for the agent to perform harmful actions, but the powerful capabilities could be leveraged for abuse if the agent were compromised by an external prompt injection or if the skill's author had hidden malicious intent. The hardcoded path `/home/bastianberrios/proyectos/HAKKE/hakke-app` in `SKILL.md` is a minor robustness issue but not malicious.