此报告尚无所请求语言的翻译，当前显示规范英文报告。
- 技能名称
- supabase
- 版本
- v8
- 维护者
- Acurioustractor
- 覆盖范围
- 3 已扫描文件 · 464 分析行数
- 策略版本
- 不可用
已确认问题的最高严重性
低
有 55 个已确认的安全问题需要处理。
安装上下文
历史证据
本报告可能无法描述当前可安装的 artifact。请打开当前 Skill 详情页查看安装建议。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
The code execution and network alerts are false positives caused by Markdown fences, inline code, and schema text. The relationship maps and sample queries do expose detailed internal Supabase schema, which is a low-risk reconnaissance concern if published broadly. No prompt injection, secret exfiltration, or executable malware behavior was found.
报告位置
历史报告
使用本报告安装前，请先查看审计历史。
审计证明
无法签发证明
所需的不可变绑定不完整。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
3 已扫描文件 · 464 分析行数
有 55 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
绑定不可用
构件
身份信息不完整
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
本次审计未记录
网络访问
可能连接外部服务。
在 2 个证据位置观察到
文件系统访问
可能读取或写入本地文件。
本次审计未记录
环境变量
可能读取进程环境中的值。
本次审计未记录
外部命令
可能调用 Skill 之外的命令或程序。
在 20 个证据位置观察到
风险问题
已确认的安全问题与仍需审核的项目分开展示。
已确认安全问题 (55)
RISK-001 低
System reconnaissance
profiles.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-002 低
System reconnaissance
organisations.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-003 低
System reconnaissance
organization_members.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-004 低
System reconnaissance
organization_members.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-005 低
System reconnaissance
tenant_members.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-006 低
System reconnaissance
tenant_members.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-007 低
System reconnaissance
projects.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-008 低
System reconnaissance
projects.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-009 低
System reconnaissance
project_participants.project_id → projects.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-010 低
System reconnaissance
project_participants.storyteller_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-011 低
System reconnaissance
stories.storyteller_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-012 低
System reconnaissance
stories.author_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-013 低
System reconnaissance
stories.project_id → projects.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-014 低
System reconnaissance
stories.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-015 低
System reconnaissance
stories.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-016 低
System reconnaissance
stories.featured_media_id → media_assets.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-017 低
System reconnaissance
transcripts.storyteller_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-018 低
System reconnaissance
transcripts.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-019 低
System reconnaissance
media_assets.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-020 低
System reconnaissance
media_assets.project_id → projects.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-021 低
System reconnaissance
media_assets.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-022 低
System reconnaissance
media_assets.uploader_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-023 低
System reconnaissance
media_assets.gallery_id → galleries.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-024 低
System reconnaissance
story_distributions.story_id → stories.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-025 低
System reconnaissance
story_distributions.created_by → users.id (auth.users)
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-026 低
System reconnaissance
story_distributions.revoked_by → users.id (auth.users)
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-027 低
System reconnaissance
embed_tokens.story_id → stories.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-028 低
System reconnaissance
embed_tokens.distribution_id → story_distributions.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-029 低
System reconnaissance
extracted_quotes.author_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-030 低
System reconnaissance
extracted_quotes.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-031 低
System reconnaissance
extracted_quotes.project_id → projects.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-032 低
System reconnaissance
audit_logs.actor_id → users.id (auth.users)
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-033 低
System reconnaissance
deletion_requests.user_id → users.id (auth.users)
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-034 低
System reconnaissance
deletion_requests.processed_by → users.id (auth.users)
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-035 低
System reconnaissance
profile_locations.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-036 低
System reconnaissance
profile_locations.location_id → locations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-037 低
System reconnaissance
profile_organizations.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-038 低
System reconnaissance
profile_organizations.organization_id → organisations.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-039 低
System reconnaissance
profile_projects.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-040 低
System reconnaissance
profile_projects.project_id → projects.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-041 低
System reconnaissance
media_usage_tracking.media_id → media_assets.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-042 低
System reconnaissance
media_usage_tracking.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-043 低
System reconnaissance
media_usage_tracking.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-044 低
System reconnaissance
user_reports.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-045 低
System reconnaissance
user_reports.reported_by → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-046 低
System reconnaissance
user_reports.resolved_by → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-047 低
System reconnaissance
user_reports.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-048 低
System reconnaissance
user_sessions.profile_id → profiles.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-049 低
System reconnaissance
user_sessions.tenant_id → tenants.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-050 低
System reconnaissance
- `tenant_id UUID REFERENCES tenants(id)`
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-051 低
System reconnaissance
LEFT JOIN stories s ON s.storyteller_id = st.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-052 低
System reconnaissance
WHERE st.id = 'uuid'
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-053 低
System reconnaissance
LEFT JOIN story_themes st ON st.story_id = s.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-054 低
System reconnaissance
LEFT JOIN narrative_themes nt ON nt.id = st.theme_id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
RISK-055 低
System reconnaissance
LEFT JOIN stories s ON s.storyteller_id = st.id
The cited content publishes exact database table, relationship, or query structure for the referenced application. This is not malware, but public disclosure can aid reconnaissance against that system.
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001低Public database schema disclosurePublish this skill only for intended project users, or redact sensitive table names, auth relationships, and tenant structure before listing it publicly.
- FIX-002低Scanner noise from documentation formattingKeep examples clearly labeled as SQL or TypeScript documentation and avoid ambiguous shell-style snippets in Markdown.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- 不可用
- 内容哈希
- 不可用
- 目录树哈希
- 不可用
- Skill 路径
- 不可用
- 审计载荷哈希
- 不可用
分析元数据
审计模型: codex
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: not_attestable