rls-policy-auditor

What problem does it solve?

This Skill audits row-level security policies to verify that tenant-scoped database data is actually protected, not just configured. It finds missing tenant filters, write-side gaps, recursion, unsafe helpers, overly broad grants, and other conditions that can leak or corrupt tenant data.

Core Features & Use Cases

• Per-command policy audit: Reviews SELECT, INSERT, UPDATE, and DELETE policies separately so read and write holes are caught independently.
• Failure-mode detection: Flags missing WITH CHECK clauses, deny-by-default gaps, policy recursion, SECURITY DEFINER risks, service-role leakage, and frontend-derived tenant scope.
• Negative-test planning: Produces runnable denial tests that prove wrong-tenant, wrong-role, and missing-auth access is blocked, with positive controls for comparison.
• Use case: A team has enabled RLS on Supabase tables and needs a rigorous audit before shipping multi-tenant features or fixing a suspected isolation bug.

Quick Start

Ask the skill to audit your tenant-table RLS policies and generate a per-command findings report plus negative-test SQL that proves cross-tenant access is denied.