このレポートには指定された言語の翻訳がありません。代わりに正規の英語レポートを表示しています。
バージョン付きセキュリティ評価
レポートID: SA-F685CBA0
7/7/2026, 6:46:09 PM
supabase セキュリティ評価 v8
スキルセキュリティ認証レポート
監査モデル: codex 過去のレポート
- スキル名
- supabase
- バージョン
- v8
- メンテナー
- Acurioustractor
- カバレッジ
- 3 スキャンされたファイル · 464 解析済み行数
- ポリシーバージョン
- 利用不可
確認済みの検出結果における最高重大度
低
55 件の確認済みセキュリティ検出結果に対応が必要です。
インストールのコンテキスト
履歴上の証拠
このレポートは、現在インストール可能な成果物を説明していない可能性があります。インストールに関するガイダンスについては、現在の Skill ページを開いてください。
現在のスキルページを開くこのレポートは、マニフェストまたは ZIP をブロックも承認もしません。
The code execution and network alerts are false positives caused by Markdown fences, inline code, and schema text. The relationship maps and sample queries do expose detailed internal Supabase schema, which is a low-risk reconnaissance concern if published broadly. No prompt injection, secret exfiltration, or executable malware behavior was found.
レポートの位置
過去のレポート
このレポートを使用してインストールする前に、監査履歴を開いてください。
監査アテステーション
証明不可
必要な不変のバインディングは不完全です。
人による検証
未検証
このレポートには人による検証は記録されていません。
カバレッジ
3 スキャンされたファイル · 464 解析済み行数
レビュー対象の項目を 55 件表示
制限事項
このレポートはランタイムまたはサンドボックスでの実行を主張するものではなく、副作用がないことを証明するものでもありません。
証拠チェーン
ソースバインディングからインストール契約まで証拠をたどってください。利用可能な証拠は検証を支援しますが、安全性を保証するものではありません。
ソース
バインディングは利用できません
アーティファクト
IDが不完全
監査
完了
確認された機能
「確認」とは、このレポートで裏付けとなる証拠が記録されていることを意味します。「記録なし」は、機能が存在しないことを証明するものではありません。
スクリプトを含む
Skillに含まれるコードを実行する場合があります。
この監査では記録されていません
ネットワークアクセス
外部サービスに接続する場合があります。
2 件の証拠箇所で確認
ファイルシステムへのアクセス
ローカルファイルの読み取りまたは書き込みを行う可能性があります。
この監査では記録されていません
環境変数
プロセス環境から値を読み取る可能性があります。
この監査では記録されていません
外部コマンド
Skillの外部にあるコマンドまたはプログラムを呼び出す場合があります。
20 件の証拠箇所で確認
リスク指摘
確認済みのセキュリティ上の懸念事項は、引き続きレビューが必要な項目と分けて表示されます。
確認済みのセキュリティ上の懸念 (55)
RISK-001 低
System reconnaissance
profiles.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-002 低
System reconnaissance
organisations.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-003 低
System reconnaissance
organization_members.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-004 低
System reconnaissance
organization_members.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-005 低
System reconnaissance
tenant_members.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-006 低
System reconnaissance
tenant_members.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-007 低
System reconnaissance
projects.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-008 低
System reconnaissance
projects.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-009 低
System reconnaissance
project_participants.project_id → projects.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-010 低
System reconnaissance
project_participants.storyteller_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-011 低
System reconnaissance
stories.storyteller_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-012 低
System reconnaissance
stories.author_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-013 低
System reconnaissance
stories.project_id → projects.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-014 低
System reconnaissance
stories.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-015 低
System reconnaissance
stories.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-016 低
System reconnaissance
stories.featured_media_id → media_assets.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-017 低
System reconnaissance
transcripts.storyteller_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-018 低
System reconnaissance
transcripts.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-019 低
System reconnaissance
media_assets.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-020 低
System reconnaissance
media_assets.project_id → projects.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-021 低
System reconnaissance
media_assets.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-022 低
System reconnaissance
media_assets.uploader_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-023 低
System reconnaissance
media_assets.gallery_id → galleries.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-024 低
System reconnaissance
story_distributions.story_id → stories.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-025 低
System reconnaissance
story_distributions.created_by → users.id (auth.users)
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-026 低
System reconnaissance
story_distributions.revoked_by → users.id (auth.users)
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-027 低
System reconnaissance
embed_tokens.story_id → stories.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-028 低
System reconnaissance
embed_tokens.distribution_id → story_distributions.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-029 低
System reconnaissance
extracted_quotes.author_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-030 低
System reconnaissance
extracted_quotes.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-031 低
System reconnaissance
extracted_quotes.project_id → projects.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-032 低
System reconnaissance
audit_logs.actor_id → users.id (auth.users)
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-033 低
System reconnaissance
deletion_requests.user_id → users.id (auth.users)
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-034 低
System reconnaissance
deletion_requests.processed_by → users.id (auth.users)
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-035 低
System reconnaissance
profile_locations.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-036 低
System reconnaissance
profile_locations.location_id → locations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-037 低
System reconnaissance
profile_organizations.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-038 低
System reconnaissance
profile_organizations.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-039 低
System reconnaissance
profile_projects.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-040 低
System reconnaissance
profile_projects.project_id → projects.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-041 低
System reconnaissance
media_usage_tracking.media_id → media_assets.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-042 低
System reconnaissance
media_usage_tracking.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-043 低
System reconnaissance
media_usage_tracking.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-044 低
System reconnaissance
user_reports.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-045 低
System reconnaissance
user_reports.reported_by → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-046 低
System reconnaissance
user_reports.resolved_by → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-047 低
System reconnaissance
user_reports.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-048 低
System reconnaissance
user_sessions.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-049 低
System reconnaissance
user_sessions.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-050 低
System reconnaissance
- `tenant_id UUID REFERENCES tenants(id)`
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-051 低
System reconnaissance
LEFT JOIN stories s ON s.storyteller_id = st.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-052 低
System reconnaissance
WHERE st.id = 'uuid'
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-053 低
System reconnaissance
LEFT JOIN story_themes st ON st.story_id = s.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-054 低
System reconnaissance
LEFT JOIN narrative_themes nt ON nt.id = st.theme_id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-055 低
System reconnaissance
LEFT JOIN stories s ON s.storyteller_id = st.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
是正措置
この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。
- FIX-001低Public database schema disclosurePublish this skill only for intended project users, or redact sensitive table names, auth relationships, and tenant structure before listing it publicly.
- FIX-002低Scanner noise from documentation formattingKeep examples clearly labeled as SQL or TypeScript documentation and avoid ambiguous shell-style snippets in Markdown.
専門家による証拠
不変の対象ID、スキャナーメタデータ、除外された一致項目、およびソースレベルの証拠。
アーティファクト主体
- Marketplace コミット
- 利用不可
- コンテンツハッシュ
- 利用不可
- ツリーハッシュ
- 利用不可
- Skill パス
- 利用不可
- 監査ペイロードハッシュ
- 利用不可
分析メタデータ
監査モデル: codex
分析状態: 完了
対象範囲は、記録されたファイル、行、メソッド、および証拠に限定されます。ランタイムまたはサンドボックスでの実行は主張していません。
検証とエクスポート
マニフェストとロックファイルは、インストール成果物を暗号学的ハッシュに結び付けます。この完全性に関する主張は、セキュリティ評価とは別のものです。
監査アテステーション: not_attestable