技能 supabase-rls-review
📦
supabase-rls-review
內容修訂 r1 安全 ⚙️ 外部命令🌐 網路存取
Review Supabase RLS and Database Grants
Supabase migrations can leave tables exposed or deny intended Data API access. This skill reviews migration history for RLS, policy, function, and grant issues.
支援: Claude Codex Code(CC)
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "supabase-rls-review" from https://skillstore.io/skills/edtrackai-supabase-rls-review.md and its manifest at https://skillstore.io/api/skills/edtrackai-supabase-rls-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「supabase-rls-review」。 Illustrative review of a public table without RLS and an unrestricted authenticated write policy.
預期結果:
- Two critical findings: R1 identifies missing RLS, and R2 identifies an unrestricted write policy.
- Suggested fixes: enable RLS and scope write access to the authenticated owner.
- Verification gap: policies created in the dashboard were not available for review.
正在使用「supabase-rls-review」。 Illustrative review of a new table covered by an earlier blanket grant.
預期結果:
- R5 is not reported because an earlier blanket grant covers the table.
- R6 flags the blanket grant and recommends explicit per-table privileges.
- The review does not confirm live database permissions or successful Data API access.
安全審計
安全v1 • 2026/10/14 開啟版本化報告
All eight static findings are false positives: seven match Markdown code spans, and one identifies a Supabase changelog citation. The skill requests read-only migration review and explicitly acknowledges incomplete visibility and heuristic results. No evidence found of command execution, data exfiltration, or prompt injection in SKILL.md.
1
已掃描檔案
34
分析行數
0
複核項目
0
已忽略的誤報
風險因素
🌐 網路存取 (1)
最近一次完成的靜態與語意稽核未偵測到已確認的安全發現。這並不能證明該 Skill 沒有副作用。
審計單位: codex
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/edtrackai-supabase-rls-review?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/edtrackai-supabase-rls-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/edtrackai-supabase-rls-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/edtrackai-supabase-rls-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
edtrackai. (2026). supabase-rls-review security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1BibTeX 引用
@techreport{edtrackai-edtrackai-supabase-rls-review-2026,
author = {edtrackai},
title = {supabase-rls-review security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "supabase-rls-review security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "edtrackai"
date-released: "2026-10-14"
url: "https://skillstore.io/skills/edtrackai-supabase-rls-review/audits/1"
identifiers:
- type: other
value: "skillstore:edtrackai-supabase-rls-review:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
65
社群
91
規範符合度
你可以打造什麼
Review Database Access Before Launch
Check migration history for missing RLS, unrestricted writes, and broad grants before releasing a Supabase application.
Investigate Data API Permission Errors
Review per-table grants and earlier default privileges when new tables produce a 42501 permission error.
Triage Migration Security Findings
Collect file-level evidence, check identifiers, suggested fixes, and verification gaps for database access reviews.
試試這些提示
Beginner: Review Migration Security
Review my Supabase migrations for RLS and grant issues. Keep files unchanged and report findings with severity, check identifiers, locations, and suggested fixes.
Intermediate: Investigate Missing Grants
Investigate a 42501 error for [table] using the migration history. Check per-table grants, earlier blanket grants, and default privileges. Report uncertainties.
Advanced: Review Tenant Write Access
Review [migration scope] for anonymous writes, unrestricted write policies, and ownership checks. Account for later migrations and list access assumptions requiring verification.
Expert: Audit Migration History
Audit all Supabase migrations in filename order against R1 through R6. Separate missing grants from blanket-grant findings and document evidence and verification gaps.
最佳實務
- Provide the full migration history so later fixes and earlier grants can be evaluated in order.
- State intended ownership rules and required database roles before assessing policy findings.
- Verify dashboard configuration and live role behavior separately before applying suggested changes.
避免
- Treating a clean heuristic report as proof that the database is secure.
- Resolving missing-grant findings by granting access to every table.
- Applying ownership-policy suggestions without checking the actual schema and intended access model.
常見問題
Does this skill modify migrations?
The default workflow is read-only. File edits require a separate user request for fixes.
Which database issues does it check?
It checks missing RLS, unrestricted writes, anonymous write policies, security definer search paths, missing per-table grants, and blanket privileges.
Can it inspect policies created in the Supabase dashboard?
Not from migration files alone. The report identifies dashboard policies and externally created tables as verification gaps.
Does it account for later migrations?
Yes. It reads files in filename order so later changes can resolve earlier issues and earlier privileges can cover later tables.
Can it help investigate a 42501 error?
It can identify missing grants in migration history. It does not test the Data API or verify live database permissions.
Does a clean review guarantee security?
No. The checks are heuristics, and runtime permissions, dashboard configuration, and application behavior require separate verification.