supabase-rls-review
Review Supabase RLS and Database Grants
Supabase migrations can leave tables exposed or deny intended Data API access. This skill reviews migration history for RLS, policy, function, and grant issues.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Review the Skillstore skill "supabase-rls-review" from https://skillstore.io/skills/edtrackai-supabase-rls-review.md and its manifest at https://skillstore.io/api/skills/edtrackai-supabase-rls-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "supabase-rls-review". Illustrative review of a public table without RLS and an unrestricted authenticated write policy.
Resultado esperado:
- Two critical findings: R1 identifies missing RLS, and R2 identifies an unrestricted write policy.
- Suggested fixes: enable RLS and scope write access to the authenticated owner.
- Verification gap: policies created in the dashboard were not available for review.
Usando "supabase-rls-review". Illustrative review of a new table covered by an earlier blanket grant.
Resultado esperado:
- R5 is not reported because an earlier blanket grant covers the table.
- R6 flags the blanket grant and recommends explicit per-table privileges.
- The review does not confirm live database permissions or successful Data API access.
Auditoría de seguridad
SeguroAll eight static findings are false positives: seven match Markdown code spans, and one identifies a Supabase changelog citation. The skill requests read-only migration review and explicitly acknowledges incomplete visibility and heuristic results. No evidence found of command execution, data exfiltration, or prompt injection in SKILL.md.
Factores de riesgo
⚙️ Comandos externos (7)
🌐 Acceso a red (1)
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/edtrackai-supabase-rls-review?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/edtrackai-supabase-rls-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/edtrackai-supabase-rls-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/edtrackai-supabase-rls-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
edtrackai. (2026). supabase-rls-review security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1Cita BibTeX
@techreport{edtrackai-edtrackai-supabase-rls-review-2026,
author = {edtrackai},
title = {supabase-rls-review security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "supabase-rls-review security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "edtrackai"
date-released: "2026-10-14"
url: "https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1"
identifiers:
- type: other
value: "skillstore:edtrackai-supabase-rls-review:audit:1"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: MedioLo que puedes crear
Review Database Access Before Launch
Check migration history for missing RLS, unrestricted writes, and broad grants before releasing a Supabase application.
Investigate Data API Permission Errors
Review per-table grants and earlier default privileges when new tables produce a 42501 permission error.
Triage Migration Security Findings
Collect file-level evidence, check identifiers, suggested fixes, and verification gaps for database access reviews.
Prueba estos prompts
Review my Supabase migrations for RLS and grant issues. Keep files unchanged and report findings with severity, check identifiers, locations, and suggested fixes.
Investigate a 42501 error for [table] using the migration history. Check per-table grants, earlier blanket grants, and default privileges. Report uncertainties.
Review [migration scope] for anonymous writes, unrestricted write policies, and ownership checks. Account for later migrations and list access assumptions requiring verification.
Audit all Supabase migrations in filename order against R1 through R6. Separate missing grants from blanket-grant findings and document evidence and verification gaps.
Mejores prácticas
- Provide the full migration history so later fixes and earlier grants can be evaluated in order.
- State intended ownership rules and required database roles before assessing policy findings.
- Verify dashboard configuration and live role behavior separately before applying suggested changes.
Evitar
- Treating a clean heuristic report as proof that the database is secure.
- Resolving missing-grant findings by granting access to every table.
- Applying ownership-policy suggestions without checking the actual schema and intended access model.