skills.rest
amoai-tech
amoai-techCOMMUNITY
Explore all skills by this author →
GitHub

supabase-review

Reviews Supabase migrations, RLS policies, RPCs, and grants for security and data-integrity defects.

1|Updated Sep 15, 2026
Search Tags:#code review#migrations#rls#supabase#security review#rpc#postgres
One-click install
npx skills add https://github.com/amoai-tech/mdeai --skill supabase-review-amoai-tech
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supabase-review
Source: https://github.com/amoai-tech/mdeai/tree/main/.claude/skills/supabase-review
Command: npx skills add https://github.com/amoai-tech/mdeai --skill supabase-review-amoai-tech

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Supabase schema changes can silently introduce security holes—broken RLS policies, over-privileged grants, unsafe SECURITY DEFINER functions, or RPCs that trust user-supplied ownership IDs. This Skill provides a structured review checklist to catch material security and data-integrity defects before they ship. ## Core Features & Use Cases - RLS and ownership enforcement review: Verifies that row-level security stays enabled and that User A cannot read, update, or delete User B's data. - Privilege and function auditing: Checks SECURITY DEFINER functions, grants/revokes, and service-role usage against least-privilege principles. - Migration safety checks: Ensures migrations are ordered, replay-aware, and keep generated types and callers aligned. - Use Case: Before merging a PR that adds a new bookings table with RLS policies and an RPC, run this review to confirm the policy predicates are server-enforced and the RPC derives caller authority rather than trusting client-supplied IDs. ## Quick Start Review the Supabase migrations and RLS policies in this pull request for security and data-integrity defects.

Frequently Asked Questions about supabase-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review Supabase RLS policies for security issues?▼

Verify RLS stays enabled on all tables and that ownership or tenant predicates are server-enforced. Test with authenticated User A versus User B requests to prove foreign access fails deterministically while owner access succeeds.

What should I check in a Supabase migration review?▼

Check that migrations are ordered, replay-aware, and compatible with the repository's migration workflow. Confirm schema changes keep generated types and caller code aligned, and that grants preserve least privilege.

Why are SECURITY DEFINER functions risky in Postgres?▼

SECURITY DEFINER functions execute with the owner's privileges, so they require deliberate ownership, restricted grants, and a safe search_path. Without these, attackers can escalate privileges or hijack object resolution.

Can RPCs trust user-supplied ownership IDs in Supabase?▼

No. RPCs must derive or verify caller authority server-side rather than trusting client-supplied ownership IDs. Accepting user-provided IDs lets one user act on another user's data.

When should the service role key never be used?▼

Never expose service-role credentials to clients or use the service role as a shortcut for client authorization. It bypasses RLS entirely, so it must stay server-side with strict boundaries.

Related Skills

Explore More Software Engineering Skills→
Tomy74-vscTomy74-vsc

supabase-db-rpc-auditor

Audit Supabase schema, RPCs, views, and RLS policies against SQL migrations and application code.

Community
Advanced
AndurilCodeAndurilCode
7

test-challenger

Challenge unit tests to detect false positives from implementation-derived oracles.

Official
Advanced
Seva-EatsSeva-Eats

supabase-postgres-best-practices

Review and rewrite Postgres queries, schemas, and RLS policies for Supabase.

Official
Advanced
rabbicserabbicse

ai-qa-review

Detect quality problems in test code with line-level smell analysis.

Community
Advanced