What makes Supabase Security Auditor notable?

979 downloads. Trust evidence available

How should Supabase Security Auditor be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

Supabase Security Auditor

Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security. Skill: Supabase Security Auditor Owner: charlie-morrison Summary: Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security. Tags: latest:1.0.0 Version history: v1.0.0 | 2026-05-01T14:48:00.812Z | auto Initial release: audit Supabase projects for security vulnerabilities. - Checks Row Level Security (RLS) policies, highlights

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

979

Updated

Oct 11, 2026

Version

1.0.0

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 979 downloads reported by the source. Last updated 10/11/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 11, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 11, 2026
Adoption signal: 979 downloadsadoption · observed Oct 11, 2026
Latest release: 1.0.0release · observed May 1, 2026
Handshake status: UNKNOWNsecurity

What changed

Newest first. Only changes that point at a source are listed.

Release 1.0.0release
Initial release: audit Supabase projects for security vulnerabilities. - Checks Row Level Security (RLS) policies, highlights missing or weak controls. - Reviews authentication setup, including email confirmation, password strength, and auth provider configuration. - Detects API key exposure in code and environment files, especially service_role key misuse. - Assesses storage bucket configuration and storage policy security. - Examines edge function security: CORS, input validation, rate limiting, and secret handling. - Includes database-wide checks: triggers, SECURITY DEFINER functions, and view permissions. - Provides clear, actionable security findings in summary and detailed output.
Observed May 1, 2026 · source

Install and run

Setup complexity: medium.

clawhub skill install s17cttbdxry5kkyafjw983mq8s83p4y3:supabase-security-auditor

Setup complexity is MEDIUM. Standard integration tests and API key provisioning are required before connecting this to production workloads.
Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-charlie-morrison-supabase-security-auditor/snapshot"

Run-check

$0.02 USD

1 measured facts are behind this paywall: success rate and latency, uptime and estimated cost, when not to use it, how to call it, benchmark scores.

Agents pay $0.02 in USDC. A card payment is $0.50, the smallest a card allows.

Documentation

CLAWHUB

7,620 characters of source documentation, loaded on request.

Extracted files

3 files captured from the source.

SKILL.md

---
name: supabase-security-auditor
description: Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security.
metadata:
  tags: ["supabase", "security", "postgres", "auth", "rls"]
---

# Supabase Security Auditor

Audit Supabase projects for security vulnerabilities including Row Level Security (RLS) policies, authentication configuration, API key exposure, storage bucket rules, and edge function security. Use before launching, after configuration changes, or during security reviews.

## Usage

```
"Audit my Supabase project for security"
"Check RLS policies on all tables"
"Review auth configuration for vulnerabilities"
"Are my Supabase storage buckets secure?"
```

## How It Works

### 1. Project Discovery

```bash
# Find Supabase config
cat supabase/config.toml 2>/dev/null
ls supabase/migrations/ 2>/dev/null | tail -10
# Find API usage
grep -rn "createClient\|supabase\." src/ lib/ app/ | head -20
# Check for exposed keys
grep -rn "SUPABASE_\|supabase\.\(url\|key\|anon\)" .env* src/ | head -10
```

### 2. Row Level Security (RLS)

**Critical checks:**
- Tables without RLS enabled (exposed to anon/authenticated)
- RLS policies that are too permissive (`using (true)`)
- Missing policies for INSERT/UPDATE/DELETE (only SELECT covered)
- Policies using `auth.uid()` correctly for ownership
- Service role bypass patterns
- Policies on junction/join tables

**Common vulnerabilities:**
```sql
-- BAD: Anyone can read all users
create policy "public read" on users for select using (true);

-- GOOD: Users can only read own profile
create policy "own profile" on users for select 
  using (auth.uid() = id);

-- BAD: No RLS means API exposes everything
-- (table has no policies at all)
```

### 3. Auth Configuration

- Email confirmations enabled/disabled
- Password strength requirements
- OAuth providers properly configured
- JWT expiry times appropriate
- Custom claims validation
- Magic link vs password vs OAuth strategy
- Rate limiting on auth endpoints

### 4. API Key Security

- `anon` key: only used client-side, limited by RLS
- `service_role` key: NEVER exposed to client
- Check for service_role key in frontend code
- Environment variable usage vs hardcoded keys
- Key rotation policy

### 5. Storage Security

- Public vs private bucket configuration
- File upload size limits
- Allowed MIME types
- Storage policies matching RLS patterns
- Signed URL expiry times

### 6. Edge Functions

- CORS configuration
- Input validation
- Error handling (no stack traces in responses)
- Rate limiting
- Secret management (env vars vs hardcoded)

### 7. Database Security

- Functions with `SECURITY DEFINER` (runs as owner, not caller)
- Triggers that bypass RLS
- Views that expose sensitive data
- Proper role permissions (anon vs authenticated vs service_role)

## Output

```
## Supabase Security Audit

**Project:** my-app | **Tables:** 12 | **RLS Enabled:** 8/12

### 🔴 Critical

_meta.json

{
  "ownerId": "kn7d5eszdfwftk153ymhdm4qhs83qsqy",
  "slug": "supabase-security-auditor",
  "version": "1.0.0",
  "publishedAt": 1777646880812
}

skill-card.md

## Description:

Audit Supabase projects for security - check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security.

This skill is ready for commercial/non-commercial use.

## Publisher:

[charlie-morrison](https://clawhub.ai/user/charlie-morrison)

### License/Terms of Use:

MIT-0

## Use Case:

Developers and engineers use this skill to review Supabase applications before launch, after configuration changes, or during security reviews. It helps identify weak Row Level Security policies, exposed API keys, unsafe auth settings, storage issues, and edge function risks.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: Project inspection can expose Supabase configuration, source files, and secret-like values in reports or transcripts.

Mitigation: Use the skill only on projects where agent inspection is acceptable, and redact service_role keys, passwords, JWTs, connection strings, and other secrets before sharing outputs.

Risk: Example discovery commands that search environment files or source code may print sensitive values.

Mitigation: Review command output locally and mask secret values before including findings in tickets, chat, or public reports.

## Reference(s):


## Skill Output:

**Output Type(s):** [Text, Markdown, Shell commands, Guidance]

**Output Format:** [Markdown audit report with severity-ranked findings, tables, and inline shell or SQL remediation commands]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [May include project file paths, security findings, and remediation steps; redact secrets before sharing.]

## Skill Version(s):

1.0.0 (source: server release evidence)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Github ReposUpdated 3d agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW

Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular