Detect misconfigurations and vulnerabilities in Supabase deployments.
npx skills add https://github.com/xalgord/xalgorix --skill supabase-xalgord
Please help me install this Agent Skill. Skill: supabase Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/technologies/supabase Command: npx skills add https://github.com/xalgord/xalgorix --skill supabase-xalgord
Identifies misconfigurations and security gaps in Supabase projects that lead to unauthorized data access, tenant isolation failures, leaked service_role keys, unsafe RPCs, exposed storage, and Edge Function token misuse. It helps security engineers find practical attack vectors across REST/PostgREST, GraphQL, Realtime, Storage, Auth, and Edge Functions so vulnerabilities can be fixed before abuse.
Run a Supabase security sweep against https://example.supabase.co to detect RLS misconfigurations, exposed service_role keys, insecure storage buckets, unsafe RPCs, and Edge Function token misuse.
High-intent search queries and answers about installing and using this skill.
Test Supabase RLS bypasses by validating tenant isolation and IDOR patterns across select, insert, update, and delete actions using anon, user, and admin principals. This identifies missing or overly permissive policies that lead to unauthorized data access during security audits.
Check for leaked Supabase service_role keys by scanning Edge Function artifacts and responses for reflected secrets. Verify that functions enforce JWT issuer and audience binding to prevent token misuse and unauthorized admin-level API access.
Audit Supabase storage by testing for public buckets, listing leaks, signed URL misuse, content-type abuse, and path normalization issues. This reveals insecure storage policies and exposed objects during penetration tests.
Pentest Supabase PostgREST by exercising filters, embeds, and mass-assignment vectors against RPC endpoints. Validate SECURITY DEFINER versus INVOKER semantics to reveal function-level privilege bypasses and unsafe remote procedure calls.
You can run CI security gates to validate Supabase Realtime channel guards, subscription isolation, GraphQL overfetching, and schema-introspection risks. This ensures tenant separation and prevents unauthorized data subscriptions in automated pipelines.
A Supabase security sweep might miss insecure PostgREST filter behavior if it does not exercise embedding vectors or validate principal context across anon, user, and admin roles. Proper sweeps map endpoints and produce minimal reproducible requests demonstrating unauthorized access.
maneeshanifScaffold FastAPI backends with UV, SQLModel, Alembic, and testing.
wgpsecGenerate structured penetration testing reports with CVSS risk ratings and remediation guidance.
RedHatProductSecurityEnforce JWT validation and encrypted token storage in MCP servers.
sseshachalaDetect API misconfigurations and abuse vectors in REST and GraphQL services.
