Senior Supabase RLS+Auth Boundary Auditor for tenant isolation gaps in migrations and policy DDL BEFORE deploy. Activates when DECISIONS.md mentions Supabase or multi-tenant without an RLS policy locked, when IMPLEMENTATIONPLAN.md adds a Supabase table without an RLS policy in slice acceptance, when TASKSTATE.md Active files in scope includes /supabase/migrations/ or /sql/, or when PRPACKAGE.md draft includes DDL touching a tenant-scoped table. Catches: USING without WITH CHECK, RLS enabled without FORCE ROW LEVEL SECURITY, missing policies on join/audit tables, missing tenant predicates, SECURITY DEFINER functions without RLS-aware guards, unjustified servicerole bypass. Do not use when the project is single-tenant, when RLS is intentionally disabled with documented rationale, for general non-DB security review (use security-review), or when the audit has already completed for the current migration set.
Install with
Claude CodeCodexCursorGitHub CopilotGemini CLI
Supported by the Atlas install prompt. Skill-specific requirements vary.
Skill stats
Skills1CategorySecurityStars0
About this skill
Senior Supabase RLS+Auth Boundary Auditor for tenant isolation gaps in migrations and policy DDL BEFORE deploy. Activates when DECISIONS.md mentions Supabase or multi-tenant without an RLS policy locked, when IMPLEMENTATIONPLAN.md adds a Supabase table without an RLS policy in slice acceptance, when TASKSTATE.md Active files in scope includes /supabase/migrations/ or /sql/, or when PRPACKAGE.md draft includes DDL touching a tenant-scoped table. Catches: USING without WITH CHECK, RLS enabled without FORCE ROW LEVEL SECURITY, missing policies on join/audit tables, missing tenant predicates, SECURITY DEFINER functions without RLS-aware guards, unjustified servicerole bypass. Do not use when the project is single-tenant, when RLS is intentionally disabled with documented rationale, for general non-DB security review (use security-review), or when the audit has already completed for the current migration set.
Quick start
Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.
Senior Supabase RLS+Auth Boundary Auditor for tenant isolation gaps in migrations and policy DDL BEFORE deploy. Activates when DECISIONS.md mentions Supabase or multi-tenant without an RLS policy locked, when IMPLEMENTATION_PLAN.md adds a Supabase table without an RLS policy in slice acceptance, when TASK_STATE.md ## Active files in scope includes /supabase/migrations/ or /sql/, or when PR_PACKAGE.md draft includes DDL touching a tenant-scoped table. Catches: USING without WITH CHECK, RLS enabled without FORCE ROW LEVEL SECURITY, missing policies on join/audit tables, missing tenant predicates, SECURITY DEFINER functions without RLS-aware guards, unjustified service_role bypass. Do not use when the project is single-tenant, when RLS is intentionally disabled with documented rationale, for general non-DB security review (use security-review), or when the audit has already completed for the current migration set.
About this listing
Category
Security
Reported license
MIT
Listing language (estimated)
English
Review status
Not individually reviewed
Agent compatibility
Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.
Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLI