{"id":"74b2bd8f-e2f6-4fca-ac78-ac513212f353","entityType":"agent","slug":"clawhub-charlie-morrison-supabase-security-auditor","name":"Supabase Security Auditor","canonicalUrl":"https://www.xpersona.co/agent/clawhub-charlie-morrison-supabase-security-auditor","canonicalPath":"/agent/clawhub-charlie-morrison-supabase-security-auditor","generatedAt":"2026-10-12T13:17:36.874Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-10-11T23:09:59.474Z","emptyReason":null},"description":"Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security. Skill: Supabase Security Auditor Owner: charlie-morrison Summary: Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security. Tags: latest:1.0.0 Version history: v1.0.0 | 2026-05-01T14:48:00.812Z | auto Initial release: audit Supabase projects for security vulnerabilities. - Checks Row Level Security (RLS) policies, highlights","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 979 downloads reported by the source. Last updated 10/11/2026.","installCommand":"clawhub skill install s17cttbdxry5kkyafjw983mq8s83p4y3:supabase-security-auditor","sourceUrl":"https://clawhub.ai/charlie-morrison/supabase-security-auditor","homepage":"https://clawhub.ai/charlie-morrison/skills/supabase-security-auditor","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/charlie-morrison/supabase-security-auditor","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/charlie-morrison/skills/supabase-security-auditor","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":60,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security. Skill: Su"},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-11T23:09:59.474Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T23:09:59.474Z","emptyReason":null},"stars":null,"forks":null,"downloads":979,"likes":null,"task":null,"library":null,"packageName":null,"latestVersion":"1.0.0","tractionLabel":"979 downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T23:09:59.403Z","emptyReason":null},"lastUpdatedAt":"2026-10-11T23:09:59.474Z","lastCrawledAt":"2026-10-11T23:09:59.403Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-12T23:09:59.403Z","lastVerifiedAt":null,"highlights":[{"version":"1.0.0","createdAt":"2026-05-01T14:48:00.812Z","changelog":"Initial release: audit Supabase projects for security vulnerabilities. - Checks Row Level Security (RLS) policies, highlights missing or weak controls. - Reviews authentication setup, including email confirmation, password strength, and auth provider configuration. - Detects API key exposure in code and environment files, especially service_role key misuse. - Assesses storage bucket configuration and storage policy security. - Examines edge function security: CORS, input validation, rate limiting, and secret handling. - Includes database-wide checks: triggers, SECURITY DEFINER functions, and view permissions. - Provides clear, actionable security findings in summary and detailed output.","fileCount":3,"zipByteSize":3537}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s17cttbdxry5kkyafjw983mq8s83p4y3:supabase-security-auditor","setupComplexity":"medium","setupSteps":["Setup complexity is MEDIUM. Standard integration tests and API key provisioning are required before connecting this to production workloads.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-charlie-morrison-supabase-security-auditor/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-charlie-morrison-supabase-security-auditor/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-charlie-morrison-supabase-security-auditor/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-charlie-morrison-supabase-security-auditor/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-charlie-morrison-supabase-security-auditor/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-charlie-morrison-supabase-security-auditor/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-12T13:17:36.873Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-charlie-morrison-supabase-security-auditor/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-charlie-morrison-supabase-security-auditor/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-charlie-morrison-supabase-security-auditor/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-charlie-morrison-supabase-security-auditor/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-10-11T23:09:59.474Z","emptyReason":null},"readme":"Skill: Supabase Security Auditor\n\nOwner: charlie-morrison\n\nSummary: Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security.\n\nTags: latest:1.0.0\n\nVersion history:\n\nv1.0.0 | 2026-05-01T14:48:00.812Z | auto\n\nInitial release: audit Supabase projects for security vulnerabilities.\n\n- Checks Row Level Security (RLS) policies, highlights missing or weak controls.\n- Reviews authentication setup, including email confirmation, password strength, and auth provider configuration.\n- Detects API key exposure in code and environment files, especially service_role key misuse.\n- Assesses storage bucket configuration and storage policy security.\n- Examines edge function security: CORS, input validation, rate limiting, and secret handling.\n- Includes database-wide checks: triggers, SECURITY DEFINER functions, and view permissions.\n- Provides clear, actionable security findings in summary and detailed output.\n\nArchive index:\n\nArchive v1.0.0: 3 files, 3537 bytes\n\nFiles: skill-card.md (1991b), SKILL.md (4364b), _meta.json (144b)\n\nFile v1.0.0:SKILL.md\n\n---\nname: supabase-security-auditor\ndescription: Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security.\nmetadata:\n  tags: [\"supabase\", \"security\", \"postgres\", \"auth\", \"rls\"]\n---\n\n# Supabase Security Auditor\n\nAudit Supabase projects for security vulnerabilities including Row Level Security (RLS) policies, authentication configuration, API key exposure, storage bucket rules, and edge function security. Use before launching, after configuration changes, or during security reviews.\n\n## Usage\n\n```\n\"Audit my Supabase project for security\"\n\"Check RLS policies on all tables\"\n\"Review auth configuration for vulnerabilities\"\n\"Are my Supabase storage buckets secure?\"\n```\n\n## How It Works\n\n### 1. Project Discovery\n\n```bash\n# Find Supabase config\ncat supabase/config.toml 2>/dev/null\nls supabase/migrations/ 2>/dev/null | tail -10\n# Find API usage\ngrep -rn \"createClient\\|supabase\\.\" src/ lib/ app/ | head -20\n# Check for exposed keys\ngrep -rn \"SUPABASE_\\|supabase\\.\\(url\\|key\\|anon\\)\" .env* src/ | head -10\n```\n\n### 2. Row Level Security (RLS)\n\n**Critical checks:**\n- Tables without RLS enabled (exposed to anon/authenticated)\n- RLS policies that are too permissive (`using (true)`)\n- Missing policies for INSERT/UPDATE/DELETE (only SELECT covered)\n- Policies using `auth.uid()` correctly for ownership\n- Service role bypass patterns\n- Policies on junction/join tables\n\n**Common vulnerabilities:**\n```sql\n-- BAD: Anyone can read all users\ncreate policy \"public read\" on users for select using (true);\n\n-- GOOD: Users can only read own profile\ncreate policy \"own profile\" on users for select \n  using (auth.uid() = id);\n\n-- BAD: No RLS means API exposes everything\n-- (table has no policies at all)\n```\n\n### 3. Auth Configuration\n\n- Email confirmations enabled/disabled\n- Password strength requirements\n- OAuth providers properly configured\n- JWT expiry times appropriate\n- Custom claims validation\n- Magic link vs password vs OAuth strategy\n- Rate limiting on auth endpoints\n\n### 4. API Key Security\n\n- `anon` key: only used client-side, limited by RLS\n- `service_role` key: NEVER exposed to client\n- Check for service_role key in frontend code\n- Environment variable usage vs hardcoded keys\n- Key rotation policy\n\n### 5. Storage Security\n\n- Public vs private bucket configuration\n- File upload size limits\n- Allowed MIME types\n- Storage policies matching RLS patterns\n- Signed URL expiry times\n\n### 6. Edge Functions\n\n- CORS configuration\n- Input validation\n- Error handling (no stack traces in responses)\n- Rate limiting\n- Secret management (env vars vs hardcoded)\n\n### 7. Database Security\n\n- Functions with `SECURITY DEFINER` (runs as owner, not caller)\n- Triggers that bypass RLS\n- Views that expose sensitive data\n- Proper role permissions (anon vs authenticated vs service_role)\n\n## Output\n\n```\n## Supabase Security Audit\n\n**Project:** my-app | **Tables:** 12 | **RLS Enabled:** 8/12\n\n### 🔴 Critical (3)\n1. **4 tables without RLS** — orders, payments, audit_log, api_keys\n   These are fully accessible via the anon API key!\n   → Enable RLS: `alter table orders enable row level security;`\n\n2. **service_role key in frontend** — src/lib/supabase.ts:3\n   `createClient(url, 'eyJhbGciOiJIUz...')` — this key bypasses ALL RLS\n   → Use NEXT_PUBLIC_SUPABASE_ANON_KEY only in client code\n\n3. **Public storage bucket** — 'avatars' bucket is public\n   Anyone can list and download all uploaded files\n   → Set bucket to private, use signed URLs for access\n\n### 🟡 Warnings (4)\n4. profiles table: SELECT policy uses `using (true)` — all profiles public\n5. No email confirmation required — anyone can create accounts\n6. JWT expiry: 3600s default — consider shorter for sensitive apps\n7. No file type restriction on uploads — allows executables\n\n### ✅ Secure\n- Auth using PKCE flow (no implicit grant)\n- Password minimum length enforced\n- Edge functions use env vars for secrets\n- Database functions use SECURITY INVOKER\n\n### 📋 RLS Policy Coverage\n| Table | SELECT | INSERT | UPDATE | DELETE | Status |\n|-------|--------|--------|--------|--------|--------|\n| users | ✅ | ✅ | ✅ | ❌ | 🟡 |\n| posts | ✅ | ✅ | ✅ | ✅ | ✅ |\n| orders | ❌ | ❌ | ❌ | ❌ | 🔴 NO RLS |\n| payments | ❌ | ❌ | ❌ | ❌ | 🔴 NO RLS |\n```\n\nFile v1.0.0:_meta.json\n\n{\n  \"ownerId\": \"kn7d5eszdfwftk153ymhdm4qhs83qsqy\",\n  \"slug\": \"supabase-security-auditor\",\n  \"version\": \"1.0.0\",\n  \"publishedAt\": 1777646880812\n}\n\nFile v1.0.0:skill-card.md\n\n## Description:\n\nAudit Supabase projects for security - check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[charlie-morrison](https://clawhub.ai/user/charlie-morrison)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers and engineers use this skill to review Supabase applications before launch, after configuration changes, or during security reviews. It helps identify weak Row Level Security policies, exposed API keys, unsafe auth settings, storage issues, and edge function risks.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: Project inspection can expose Supabase configuration, source files, and secret-like values in reports or transcripts.\n\nMitigation: Use the skill only on projects where agent inspection is acceptable, and redact service_role keys, passwords, JWTs, connection strings, and other secrets before sharing outputs.\n\nRisk: Example discovery commands that search environment files or source code may print sensitive values.\n\nMitigation: Review command output locally and mask secret values before including findings in tickets, chat, or public reports.\n\n## Reference(s):\n\n\n## Skill Output:\n\n**Output Type(s):** [Text, Markdown, Shell commands, Guidance]\n\n**Output Format:** [Markdown audit report with severity-ranked findings, tables, and inline shell or SQL remediation commands]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [May include project file paths, security findings, and remediation steps; redact secrets before sharing.]\n\n## Skill Version(s):\n\n1.0.0 (source: server release evidence)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.","readmeExcerpt":"Skill: Supabase Security Auditor Owner: charlie-morrison Summary: Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security. Tags: latest:1.0.0 Version history: v1.0.0 | 2026-05-01T14:48:00.812Z | auto Initial release: audit Supabase projects for security vulnerabilities. - Checks Row Level Security (RLS) policies, highlights ","codeSnippets":[],"executableExamples":[{"language":"text","snippet":"\"Audit my Supabase project for security\"\n\"Check RLS policies on all tables\"\n\"Review auth configuration for vulnerabilities\"\n\"Are my Supabase storage buckets secure?\""},{"language":"bash","snippet":"# Find Supabase config\ncat supabase/config.toml 2>/dev/null\nls supabase/migrations/ 2>/dev/null | tail -10\n# Find API usage\ngrep -rn \"createClient\\|supabase\\.\" src/ lib/ app/ | head -20\n# Check for exposed keys\ngrep -rn \"SUPABASE_\\|supabase\\.\\(url\\|key\\|anon\\)\" .env* src/ | head -10"},{"language":"sql","snippet":"-- BAD: Anyone can read all users\ncreate policy \"public read\" on users for select using (true);\n\n-- GOOD: Users can only read own profile\ncreate policy \"own profile\" on users for select \n  using (auth.uid() = id);\n\n-- BAD: No RLS means API exposes everything\n-- (table has no policies at all)"},{"language":"text","snippet":"## Supabase Security Audit\n\n**Project:** my-app | **Tables:** 12 | **RLS Enabled:** 8/12\n\n### 🔴 Critical (3)\n1. **4 tables without RLS** — orders, payments, audit_log, api_keys\n   These are fully accessible via the anon API key!\n   → Enable RLS: `alter table orders enable row level security;`\n\n2. **service_role key in frontend** — src/lib/supabase.ts:3\n   `createClient(url, 'eyJhbGciOiJIUz...')` — this key bypasses ALL RLS\n   → Use NEXT_PUBLIC_SUPABASE_ANON_KEY only in client code\n\n3. **Public storage bucket** — 'avatars' bucket is public\n   Anyone can list and download all uploaded files\n   → Set bucket to private, use signed URLs for access\n\n### 🟡 Warnings (4)\n4. profiles table: SELECT policy uses `using (true)` — all profiles public\n5. No email confirmation required — anyone can create accounts\n6. JWT expiry: 3600s default — consider shorter for sensitive apps\n7. No file type restriction on uploads — allows executables\n\n### ✅ Secure\n- Auth using PKCE flow (no implicit grant)\n- Password minimum length enforced\n- Edge functions use env vars for secrets\n- Database functions use SECURITY INVOKER\n\n### 📋 RLS Policy Coverage\n| Table | SELECT | INSERT | UPDATE | DELETE | Status |\n|-------|--------|--------|--------|--------|--------|\n| users | ✅ | ✅ | ✅ | ❌ | 🟡 |\n| posts | ✅ | ✅ | ✅ | ✅ | ✅ |\n| orders | ❌ | ❌ | ❌ | ❌ | 🔴 NO RLS |\n| payments | ❌ | ❌ | ❌ | ❌ | 🔴 NO RLS |"}],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"---\nname: supabase-security-auditor\ndescription: Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security.\nmetadata:\n  tags: [\"supabase\", \"security\", \"postgres\", \"auth\", \"rls\"]\n---\n\n# Supabase Security Auditor\n\nAudit Supabase projects for security vulnerabilities including Row Level Security (RLS) policies, authentication configuration, API key exposure, storage bucket rules, and edge function security. Use before launching, after configuration changes, or during security reviews.\n\n## Usage\n\n```\n\"Audit my Supabase project for security\"\n\"Check RLS policies on all tables\"\n\"Review auth configuration for vulnerabilities\"\n\"Are my Supabase storage buckets secure?\"\n```\n\n## How It Works\n\n### 1. Project Discovery\n\n```bash\n# Find Supabase config\ncat supabase/config.toml 2>/dev/null\nls supabase/migrations/ 2>/dev/null | tail -10\n# Find API usage\ngrep -rn \"createClient\\|supabase\\.\" src/ lib/ app/ | head -20\n# Check for exposed keys\ngrep -rn \"SUPABASE_\\|supabase\\.\\(url\\|key\\|anon\\)\" .env* src/ | head -10\n```\n\n### 2. Row Level Security (RLS)\n\n**Critical checks:**\n- Tables without RLS enabled (exposed to anon/authenticated)\n- RLS policies that are too permissive (`using (true)`)\n- Missing policies for INSERT/UPDATE/DELETE (only SELECT covered)\n- Policies using `auth.uid()` correctly for ownership\n- Service role bypass patterns\n- Policies on junction/join tables\n\n**Common vulnerabilities:**\n```sql\n-- BAD: Anyone can read all users\ncreate policy \"public read\" on users for select using (true);\n\n-- GOOD: Users can only read own profile\ncreate policy \"own profile\" on users for select \n  using (auth.uid() = id);\n\n-- BAD: No RLS means API exposes everything\n-- (table has no policies at all)\n```\n\n### 3. Auth Configuration\n\n- Email confirmations enabled/disabled\n- Password strength requirements\n- OAuth providers properly configured\n- JWT expiry times appropriate\n- Custom claims validation\n- Magic link vs password vs OAuth strategy\n- Rate limiting on auth endpoints\n\n### 4. API Key Security\n\n- `anon` key: only used client-side, limited by RLS\n- `service_role` key: NEVER exposed to client\n- Check for service_role key in frontend code\n- Environment variable usage vs hardcoded keys\n- Key rotation policy\n\n### 5. Storage Security\n\n- Public vs private bucket configuration\n- File upload size limits\n- Allowed MIME types\n- Storage policies matching RLS patterns\n- Signed URL expiry times\n\n### 6. Edge Functions\n\n- CORS configuration\n- Input validation\n- Error handling (no stack traces in responses)\n- Rate limiting\n- Secret management (env vars vs hardcoded)\n\n### 7. Database Security\n\n- Functions with `SECURITY DEFINER` (runs as owner, not caller)\n- Triggers that bypass RLS\n- Views that expose sensitive data\n- Proper role permissions (anon vs authenticated vs service_role)\n\n## Output\n\n```\n## Supabase Security Audit\n\n**Project:** my-app | **Tables:** 12 | **RLS Enabled:** 8/12\n\n### 🔴 Critical"},{"path":"_meta.json","content":"{\n  \"ownerId\": \"kn7d5eszdfwftk153ymhdm4qhs83qsqy\",\n  \"slug\": \"supabase-security-auditor\",\n  \"version\": \"1.0.0\",\n  \"publishedAt\": 1777646880812\n}"},{"path":"skill-card.md","content":"## Description:\n\nAudit Supabase projects for security - check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[charlie-morrison](https://clawhub.ai/user/charlie-morrison)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers and engineers use this skill to review Supabase applications before launch, after configuration changes, or during security reviews. It helps identify weak Row Level Security policies, exposed API keys, unsafe auth settings, storage issues, and edge function risks.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: Project inspection can expose Supabase configuration, source files, and secret-like values in reports or transcripts.\n\nMitigation: Use the skill only on projects where agent inspection is acceptable, and redact service_role keys, passwords, JWTs, connection strings, and other secrets before sharing outputs.\n\nRisk: Example discovery commands that search environment files or source code may print sensitive values.\n\nMitigation: Review command output locally and mask secret values before including findings in tickets, chat, or public reports.\n\n## Reference(s):\n\n\n## Skill Output:\n\n**Output Type(s):** [Text, Markdown, Shell commands, Guidance]\n\n**Output Format:** [Markdown audit report with severity-ranked findings, tables, and inline shell or SQL remediation commands]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [May include project file paths, security findings, and remediation steps; redact secrets before sharing.]\n\n## Skill Version(s):\n\n1.0.0 (source: server release evidence)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment."}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":"Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security. Skill: Supabase Security Auditor Owner: charlie-morrison Summary: Audit Supabase projects for security — check Row Level Security policies, auth configuration, API exposure, storage rules, and edge function security. Tags: latest:1.0.0 Version history: v1.0.0 | 2026-05-01T14:48:00.812Z | auto Initial release: audit Supabase projects for security vulnerabilities. - Checks Row Level Security (RLS) policies, highlights","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":1019,"uniquenessScore":51,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-11T23:09:59.474Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-11T23:09:59.474Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-12T13:17:36.874Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}