skills.rest
ricardoo022
ricardoo022COMMUNITY
Explore all skills by this author →
GitHub

scan-fase-20

Identifies Supabase RLS weaknesses via REST and GraphQL probes, delivering vulnerability findings and remediation steps.

Updated Mar 11, 2026
Search Tags:#rls#supabase#web-security#access-control#pentest#security-testing#policy-analysis
One-click install
npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-20
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: scan-fase-20
Source: https://github.com/ricardoo022/PentestAI-with-claude-code/tree/main/.claude/skills/scan-fase-20
Command: npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-20

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Performs deep analysis of Supabase Row Level Security policies to identify subtle weaknesses, bypass vectors, and data exposure opportunities that standard checks may miss.

Core Features & Use Cases

  • Comprehensive RLS policy analysis across roles, policies, and enforcement points (USING/WITH CHECK) to reveal gaps.
  • End-to-end assessment including JOIN-based bypass tests, SECURITY DEFINER function exploitation checks, view leakage, temporal table bypass checks, and PostgREST-specific attacks.
  • Schema-aware, threat-modeling oriented workflow that adapts to each database configuration and provides remediation guidance.

Quick Start

Provide the target Supabase URL and run the command /scan-fase-20 {url} to begin the assessment.

Frequently Asked Questions about scan-fase-20

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test Supabase RLS policies for security bypass vulnerabilities?▼

Supabase RLS policy analysis identifies subtle weaknesses by assessing role boundaries, JOIN-based bypass opportunities, view leakage, temporal data bypasses, and SECURITY DEFINER function exploitation to reveal data exposure vectors across the full stack.

Can I detect SECURITY DEFINER function exploitation in a Supabase database?▼

Yes, detecting SECURITY DEFINER function exploitation involves assessing function execution boundaries and PostgREST-specific attacks to reveal unauthorized data access vectors across the Supabase deployment.

What is the best way to check for JOIN-based RLS bypass opportunities in Supabase?▼

The best way to check for JOIN-based RLS bypass opportunities is to perform end-to-end policy analysis across related tables, evaluating USING and WITH CHECK enforcement points to identify gaps in access control.

Does RLS policy analysis cover temporal table bypass checks and view leakage?▼

Yes, comprehensive RLS policy analysis covers temporal table bypass checks and view leakage by issuing targeted REST and GraphQL probes to map data exposure vectors across the full stack.

How do I get structured remediation guidance for Supabase access control weaknesses?▼

You get structured remediation guidance for Supabase access control weaknesses by running a schema-aware assessment that delivers vulnerability mappings, affected tables, severity estimates, and practical remediation steps.

Related Skills

Explore More Software Engineering Skills→
devtintdevtint

api-discovery

Discover API endpoints by parsing OpenAPI specs, analyzing JavaScript, and probing common URL paths.

Community
Intermediate
dnvitidnviti
10

vulnerability-create

Generate structured remediation tasks from security vulnerability findings with severity classification.

Community
Intermediate
arroyo2009jose-maxarroyo2009jose-max

supabase

Automate Supabase schema creation, SQL migrations, and RLS policies.

Community
Advanced
BishopCodesBishopCodes
1

WebAssessment

Automate web application security assessments with OWASP testing and browser automation.

Community
Advanced