{"data":{"skill":{"slug":"sickn33-nextjs-supabase-auth","name":"nextjs-supabase-auth","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/nextjs-supabase-auth","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"8df8bd76-976b-4d65-be1a-a8950b764cfe","skill_id":"62b8aa42-2cdc-48b6-918f-0d174dae0161","version":6,"content_hash":"v3:81e05e636292629114b76cbb3922fbe57672fc02:82bbd17e1a3179f86172a438c6ef4b7b69e653cb2af1532c6fbaf957ff7b3edf:438ab93f4625be61c869ace76696e5907b795893f3b8bb48ebfd9f8618a7c8b8:736b696c6c732f7369636b6e33332f6e6578746a732d73757061626173652d61757468:97a804d5871edb0d46a75a84b52271ae","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"The command-execution alerts are false positives caused by JavaScript template literals, Markdown fences, and inline Markdown. Public Supabase environment variables are expected, but the OAuth callback contains a high-severity open redirect through its unvalidated next parameter.","remediation":[{"issue":"The OAuth callback redirects with an unvalidated next query parameter.","severity":"high","suggestion":"Allow only local paths beginning with one slash, reject protocol-relative or malformed values, and construct the redirect with a validated URL."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":131,"line_start":131},{"file":"SKILL.md","line_end":135,"line_start":135},{"file":"SKILL.md","line_end":283,"line_start":278},{"file":"SKILL.md","line_end":291,"line_start":283},{"file":"SKILL.md","line_end":295,"line_start":291},{"file":"SKILL.md","line_end":299,"line_start":295},{"file":"SKILL.md","line_end":299,"line_start":299}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":237,"line_start":237},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":237,"line_start":237}]}],"critical_findings":[],"high_findings":[{"title":"Unvalidated OAuth Callback Redirect","locations":[{"file":"SKILL.md","line_end":131,"line_start":123}],"confidence":0.98,"description":"The callback concatenates the user-controlled next query value with the site origin. Crafted values can produce an external redirect after authentication and support phishing.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The next value comes directly from URL search parameters and reaches NextResponse.redirect without validation. The data flow is explicit in the example."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":314,"audit_model":"codex","audited_at":"2026-08-04T15:59:47.786+00:00","created_at":"2026-08-05T01:36:25.620932+00:00","static_findings":[{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"return NextResponse.redirect(`${origin}${next}`)","category":"external_commands","line_end":131,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"return NextResponse.redirect(`${origin}/auth/error`)","category":"external_commands","line_end":135,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:278:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":283,"severity":"medium","line_start":278},{"id":"external_commands:SKILL.md:283:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":291,"severity":"medium","line_start":283},{"id":"external_commands:SKILL.md:291:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":295,"severity":"medium","line_start":291},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":299,"severity":"medium","line_start":295},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Works well with: `nextjs-app-router`, `supabase-backend`","category":"external_commands","line_end":299,"severity":"medium","line_start":299},{"id":"env_access:SKILL.md:38:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.NEXT_PUBLIC_SUPABASE_URL!,","category":"env_access","line_end":38,"severity":"low","line_start":38},{"id":"env_access:SKILL.md:39:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!","category":"env_access","line_end":39,"severity":"low","line_start":39},{"id":"env_access:SKILL.md:50:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.NEXT_PUBLIC_SUPABASE_URL!,","category":"env_access","line_end":50,"severity":"low","line_start":50},{"id":"env_access:SKILL.md:51:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,","category":"env_access","line_end":51,"severity":"low","line_start":51},{"id":"env_access:SKILL.md:81:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.NEXT_PUBLIC_SUPABASE_URL!,","category":"env_access","line_end":81,"severity":"low","line_start":81},{"id":"env_access:SKILL.md:82:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,","category":"env_access","line_end":82,"severity":"low","line_start":82},{"id":"env_access:SKILL.md:237:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"Fix action: Use window.location.origin or process.env.NEXT_PUBLIC_SITE_URL","category":"env_access","line_end":237,"severity":"low","line_start":237},{"id":"env_access:SKILL.md:38:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"process.env.NEXT_PUBLIC_SUPABASE_URL!,","category":"env_access","line_end":38,"severity":"low","line_start":38},{"id":"env_access:SKILL.md:39:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!","category":"env_access","line_end":39,"severity":"low","line_start":39},{"id":"env_access:SKILL.md:50:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"process.env.NEXT_PUBLIC_SUPABASE_URL!,","category":"env_access","line_end":50,"severity":"low","line_start":50},{"id":"env_access:SKILL.md:51:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,","category":"env_access","line_end":51,"severity":"low","line_start":51},{"id":"env_access:SKILL.md:81:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"process.env.NEXT_PUBLIC_SUPABASE_URL!,","category":"env_access","line_end":81,"severity":"low","line_start":81},{"id":"env_access:SKILL.md:82:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,","category":"env_access","line_end":82,"severity":"low","line_start":82},{"id":"env_access:SKILL.md:237:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"Fix action: Use window.location.origin or process.env.NEXT_PUBLIC_SITE_URL","category":"env_access","line_end":237,"severity":"low","line_start":237},{"id":"sensitive:SKILL.md:38:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"process.env.NEXT_PUBLIC_SUPABASE_URL!,","category":"sensitive","line_end":38,"severity":"high","line_start":38},{"id":"sensitive:SKILL.md:39:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!","category":"sensitive","line_end":39,"severity":"high","line_start":39},{"id":"sensitive:SKILL.md:50:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"process.env.NEXT_PUBLIC_SUPABASE_URL!,","category":"sensitive","line_end":50,"severity":"high","line_start":50},{"id":"sensitive:SKILL.md:51:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,","category":"sensitive","line_end":51,"severity":"high","line_start":51},{"id":"sensitive:SKILL.md:81:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"process.env.NEXT_PUBLIC_SUPABASE_URL!,","category":"sensitive","line_end":81,"severity":"high","line_start":81},{"id":"sensitive:SKILL.md:82:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,","category":"sensitive","line_end":82,"severity":"high","line_start":82},{"id":"sensitive:SKILL.md:237:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"Fix action: Use window.location.origin or process.env.NEXT_PUBLIC_SITE_URL","category":"sensitive","line_end":237,"severity":"high","line_start":237}],"finding_verdicts":[{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"Line 131 uses a JavaScript template literal to build a redirect URL. It does not invoke a shell or command executor.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"Line 135 uses a JavaScript template literal for a fixed error redirect. No external command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:278:ruby-shell-backtick-execution","reason":"The backticks open a Markdown code fence around a written workflow. They are not executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:283:ruby-shell-backtick-execution","reason":"The backticks close a Markdown code fence containing numbered documentation. No command is executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:291:ruby-shell-backtick-execution","reason":"The backticks open a Markdown code fence for a workflow list. The enclosed text is documentation only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","reason":"The backticks close a Markdown code fence and have no execution context. No shell command is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","reason":"Line 299 uses inline Markdown backticks around related skill names. It does not execute those names as commands.","verdict":"false_positive","confidence":1},{"id":"env_access:SKILL.md:38:environment-variable-access-dot-notation","reason":"The browser client reads the public Supabase project URL required for connection setup. It does not access a private secret.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:39:environment-variable-access-dot-notation","reason":"The browser client reads the Supabase anonymous key, which is designed for public clients protected by row-level security. No private credential is accessed.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:50:environment-variable-access-dot-notation","reason":"The server client reads the configured public Supabase project URL. The example neither enumerates environment variables nor transmits private values.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:51:environment-variable-access-dot-notation","reason":"The server client reads the intended public Supabase anonymous key. This is standard client configuration rather than sensitive environment access.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:81:environment-variable-access-dot-notation","reason":"The middleware reads the public Supabase project URL to create its client. There is no unrelated environment inspection or secret handling.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:82:environment-variable-access-dot-notation","reason":"The middleware reads the public Supabase anonymous key for normal authentication requests. The key is not a service-role secret.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:237:environment-variable-access-dot-notation","reason":"Line 237 is prose recommending a public site URL variable. It contains no executable environment access.","verdict":"false_positive","confidence":1},{"id":"env_access:SKILL.md:38:environment-variable-object","reason":"The code accesses one named public Supabase URL variable. It does not inspect or expose the environment object.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:39:environment-variable-object","reason":"The code accesses one named public anonymous-key variable. This key is intended for browser use and is not privileged.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:50:environment-variable-object","reason":"The server setup reads only the named public project URL. It does not enumerate or leak the environment object.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:51:environment-variable-object","reason":"The server setup reads only the named public anonymous key. No service-role key or other private environment value is referenced.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:81:environment-variable-object","reason":"The middleware accesses a specific public project URL variable. This is required configuration and does not expose the environment object.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:82:environment-variable-object","reason":"The middleware accesses a specific public anonymous-key variable. It does not access privileged server credentials.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:237:environment-variable-object","reason":"This line is explanatory text naming a possible public variable. No environment object is read at runtime.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:38:environment-file-access","reason":"The example reads a public project URL through process.env and does not open an environment file. The value is not sensitive.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:39:environment-file-access","reason":"The anonymous key is intentionally available to Supabase browser clients and relies on row-level security. No environment file is accessed.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:50:environment-file-access","reason":"The code reads a named public project URL from the runtime environment. It neither reads an environment file nor handles a secret.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:51:environment-file-access","reason":"The code reads the public anonymous key required by Supabase clients. It does not read a service-role key or an environment file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:81:environment-file-access","reason":"Middleware reads the public project URL from runtime configuration. There is no file operation or sensitive value in this line.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:82:environment-file-access","reason":"Middleware reads the public Supabase anonymous key, not a privileged service key. The line performs no environment-file access.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:237:environment-file-access","reason":"Line 237 is documentation suggesting a public site URL variable. It does not access a file or retrieve a sensitive value.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"Unvalidated OAuth Callback Redirect","severity":"high","locations":[{"file":"SKILL.md","line_end":131,"line_start":123}],"confidence":0.98,"description":"The callback concatenates the user-controlled next query value with the site origin. Crafted values can produce an external redirect after authentication and support phishing.","confidence_reasoning":"The next value comes directly from URL search parameters and reaches NextResponse.redirect without validation. The data flow is explicit in the example."}],"subject_marketplace_commit_sha":"81e05e636292629114b76cbb3922fbe57672fc02","subject_content_hash":"82bbd17e1a3179f86172a438c6ef4b7b69e653cb2af1532c6fbaf957ff7b3edf","subject_tree_hash":"438ab93f4625be61c869ace76696e5907b795893f3b8bb48ebfd9f8618a7c8b8","subject_plugin_path":"skills/sickn33/nextjs-supabase-auth","audit_payload_hash":"97a804d5871edb0d46a75a84b52271ae","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"81e05e636292629114b76cbb3922fbe57672fc02","contentHash":"82bbd17e1a3179f86172a438c6ef4b7b69e653cb2af1532c6fbaf957ff7b3edf","treeHash":"438ab93f4625be61c869ace76696e5907b795893f3b8bb48ebfd9f8618a7c8b8","pluginPath":"skills/sickn33/nextjs-supabase-auth","auditPayloadHash":"97a804d5871edb0d46a75a84b52271ae"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-nextjs-supabase-auth/audits/6/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}