What Supabase security problems can this skill flag?

It flags review targets such as tables with missing or disabled RLS, policies that appear permissive, missing auth.uid() ownership checks, elevated-key references in frontend code, insecure storage rules, overbroad grants, and migration drift.

Does Supabase RLS Doctor connect to or modify my live project?

No. The bundled scanner reads matching local files and prints Markdown or JSON findings. It does not connect to or modify a live Supabase project, change policies, transmit project data, or install dependencies.

Can it verify deployed Dashboard and Security Advisor settings?

Not without separately approved live-project access. Project-level settings, deployed drift, Security Advisor findings, and role-by-role runtime behavior must be verified manually or through user-approved testing.

Does a clean scan prove my Supabase database is secure?

No. The scanner is heuristic and prioritizes review targets. A release decision still needs role and operation tests, current deployed evidence, and human review of the intended authorization model.

// database security

Supabase RLS Doctor

Audit local Supabase migrations and client code for the row-level-security mistakes that can expose data, with severity, exact evidence, and a verification step for every review target.

Get it on Agensi Use the pre-launch checklist $19 / 95 credits

What it inspects

Tables with missing or disabled row-level security.
Policies that appear to grant broad anonymous or authenticated access.
Missing auth.uid() ownership checks on user-scoped data.
Secret or legacy service_role key references in frontend initialization.
Storage bucket policies, ownership rules, and public-access review targets.
Overbroad grants and multi-tenant ownership conditions.
Migration and schema evidence that may not match the intended deployed state.

What you give it

Point the workflow at the local project evidence you want reviewed: SQL migrations and policy files, Supabase client initialization code, a database schema snapshot, and storage policy configuration. Declared file scopes include its own package, matching *.sql files, and supabase/migrations/*.

The scanner uses the Python 3 standard library. If Python or matching files are unavailable, the skill falls back to its manual checklist instead of inventing a result.

What comes back

The local scanner prints Markdown or JSON findings. Each finding is ranked from Critical to Info and includes the affected object or file, exact review evidence, impact, a proposed fix, and a verification step. The checklist then covers policy semantics and live-project boundaries the heuristic scan cannot prove.

supabase-rls-doctor / review

$ scan local Supabase evidence

CRIT profiles: migration creates table without enabling RLS

HIGH posts_select: review USING (true) for public intent

MED avatars: confirm public bucket is intentional

read-only evidence, remediation, verification

Useful before

Launching a Supabase-backed web or mobile app.
Merging a migration that adds a table, policy, view, function, or storage rule.
Reviewing AI-generated SQL or an unfamiliar Supabase starter.
Separating tenant, organization, or per-user data in a multi-tenant app.
Investigating whether a public client can cross a row-ownership boundary.
Preparing a focused human review after a Security Advisor warning.

Permissions and safety boundary

Terminal and file-read permissions support the local scanner.
Read-only inspection comes first; the scanner installs nothing and transmits nothing.
It does not connect to a live Supabase project or change policies, grants, buckets, or settings.
Any write, install, deploy, delete, reset, live-account action, payment, or external lookup requires separate confirmation.
Do not paste live database credentials or elevated key values into an agent conversation.

Known limitations

The scanner is heuristic. It can identify risky patterns and missing local evidence, but it cannot prove a schema is secure or determine whether a deliberately public policy matches the product's business rules. Project-level settings, deployed drift, Security Advisor state, runtime JWT claims, and role-by-role behavior require manual or user-approved live testing.

Views, security-definer functions, grants, storage behavior, and authorization encoded outside matching files may need direct review. Treat a clean result as a smaller review queue, not a certification.

Use the Supabase RLS pre-launch checklist to build the identity-operation matrix and live evidence the local scan cannot see.

// choose with context

Is Supabase RLS Doctor the right skill?

Best fit

A local, read-only audit of a Supabase project for row-level-security mistakes: tables without RLS, policies that resolve to true, leaked service-role keys, missing auth.uid() checks, open storage buckets, overbroad grants, and migration drift.…

It returns

A local, read-only audit of a Supabase project for row-level-security mistakes: tables without RLS, policies that resolve to true, leaked service-role keys, missing auth.uid() checks, open storage buckets,….

Do not use it as

Do not treat a successful run as proof beyond the supplied files, declared scope, and evidence the skill actually checked.

Compatibility, access, version, and licence

Reads or accesses: Only the files or context you deliberately provide; review the listing before granting additional access.
Compatibility: Agents that read the open SKILL.md format. Verify runtime and service requirements at the purchase or install destination.
Version: Verify the current package version at the linked destination.
Licence: Review the package licence and seller terms at the linked destination.

What happens next

The Agensi listing opens at the current offer. Complete purchase there, inspect SKILL.md and its bundled files, then add the complete folder to your agent.

Questions

What Supabase security problems can it flag?

It flags missing or disabled RLS, apparently permissive policies, missing ownership checks, elevated-key references in frontend code, storage review targets, overbroad grants, and migration drift.

What project evidence can it inspect?

SQL migrations and policy files, Supabase client initialization code, database schema snapshots, and storage policy configuration. Declared scopes include matching SQL and migration files.

Does it connect to or modify my live project?

No. The scan is local and read-only. It does not change policies or settings, transmit project data, or install dependencies.

What does the report contain?

Severity-ranked findings with exact local evidence, impact, a suggested remediation, and a verification step, plus a manual review checklist.

Can it verify Dashboard and Security Advisor settings?

Not without separately approved live access. Deployed settings and role behavior require manual or user-approved testing.

Does a clean scan prove the database is secure?

No. It is a heuristic review tool, not a security certification. Test the intended authorization model by role and operation before launch.

Add Supabase RLS Doctor to your pre-launch review.

Current price and purchase option are shown on Agensi. The workflow starts read-only and works with agents that load SKILL.md packages.

Get Supabase RLS Doctor on Agensi