g14wxz/database-webhook-trigger-pattern
Configures Postgres triggers and database webhooks for event-driven architectures in Supabase.
77
97%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
Security
2 findings: 1 critical severity, 1 high severity. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E006: Malicious code pattern detected in skill scripts.
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
This skill directly instructs creating database triggers that POST row data via pg_net to arbitrary endpoints on INSERT/UPDATE/DELETE, enabling straightforward data exfiltration and a persistent covert channel/backdoor if pointed at untrusted external hosts.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill requires inserting the operator-provided webhook URL verbatim into the trigger SQL and into the verification report (the "Destination Endpoint"), which would expose any secret or token contained in that URL through the agent's output — creating an exfiltration risk.
Where we found it
[REDACTED]
secret · 1 site
The verification report template at line 98 instructs the agent to output the webhook URL as the "Destination Endpoint" field, which would expose any secret tokens embedded in the URL through the agent's visible output.
SKILL.md
98
| **Destination Endpoint** | The webhook URL |
webhook URL in SQL trigger function body
command · 3 sites
The plugin instructs the agent to embed the operator-provided webhook URL verbatim into the SQL CREATE FUNCTION body (line 20/35) and execute it via execute_sql (line 24), exposing any secret tokens in the URL through the SQL command output.
SKILL.md
35
url := 'https://your-project.supabase.co/functions/v1/your-handler',
SKILL.md
20
- The destination endpoint URL.
SKILL.md
24
4. Execute the `CREATE OR REPLACE FUNCTION` statement via MCP `execute_sql`.
- Audited
- Security analysis