What problem does it solve? AI coding assistants ship predictable security flaws by default: API keys inlined into client bundles, Supabase tables with row-level security disabled or set to USING (true), and user input concatenated straight into LLM system prompts. This Skill scans a repository at rest, finds those failure modes, and drives a scan-fix-rescan loop with honest, CWE-mapped findings. ## Core Features & Use Cases - Secret Leak Detection: Flags hardcoded credentials and secrets behind client-exposed env prefixes (NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_), while staying silent on publishable keys like Supabase anon keys, and always names the provider rotation step. - RLS and Authorization Verification: Treats "RLS enabled" as a claim to verify, catching missing policies, USING (true) blanket access, public storage buckets, and user_metadata-based role checks that any signed-in user can rewrite. - Prompt-Injection Taint Analysis: Traces request input to LLM sinks and fires only on higher-risk positions — system prompts or tool-enabled calls — while leaving the documented-safe user-role-message pattern unflagged. - Use Case: Point it at a Next.js + Supabase app scaffolded by an AI assistant before launch; it returns a worst-first triage list where each finding includes the exact line, the concrete exploit, the one-commit fix, and a CWE/OWASP LLM mapping, then rescans after fixes to confirm what is resolved, still present, or newly introduced. ## Quick Start Ask the assistant to run a security audit of this repository for hardcoded secrets, broken Supabase row-level security, and prompt-injection risks, then list findings worst-first with fixes.
