supabase-security

使用方法

复制安装命令，在自己的智能体环境安装前先检查源码包。
从原始文档核对所需工具、凭据和支持的宿主。
说明输入材料与期望交付物，并对照来源检查输出。

npx skills add https://github.com/perufitlife/supabase-security-skill --skill supabase-security

开始前需了解

安装不包含模型订阅、API 额度或访问文件的权限。
仓库星数和安装量反映活跃情况，不等于独立质量或安全测试。

仓库原始内容

按源仓库内容呈现，保留标题、案例、代码、表格、链接以及原文引用的演示图片。

Supabase Security Skill

A pure-Node.js audit + remediation toolkit for Supabase projects. No dependencies, runs locally, your token never leaves your machine.

What it checks

Tables with RLS disabled + grants to anon/authenticated → critical leak
Tables with RLS enabled but zero policies AND direct anon grants → defense-in-depth issue
SECURITY DEFINER functions executable by anon → privilege escalation surface
Default privileges still grant CRUD on future tables → Supabase enforces revoke by Oct 30, 2026
Public storage buckets → asset leakage
Auth signups with autoconfirm enabled → signup abuse risk

Each finding includes the exact SQL needed to fix it. The skill never applies fixes automatically — it generates, you review, you run.

How to use

Quick audit (JSON to stdout)

bash

SUPABASE_ACCESS_TOKEN=sbp_xxx \
  node scripts/audit.js <project-ref>

HTML report (recommended for sharing)

bash

SUPABASE_ACCESS_TOKEN=sbp_xxx \
  node scripts/audit.js <project-ref> --html report.html

Open report.html in any browser. Self-contained (~25KB), Tailwind + Chart.js via CDN, copy-to-clipboard buttons on every fix.

Get a token

https://supabase.com/dashboard/account/tokens → New token. Read-only is enough for the audit; remediation needs no extra scope (you run the SQL yourself).

Remediation flow

Run the audit, get the HTML report.
Review each finding. Don't blindly apply fixes. Some "high" findings (e.g. is_admin() exposed to anon) are intentional API endpoints.
Click "Copy all SQL" at the bottom and paste into Dashboard → SQL Editor.
Run inside a transaction: BEGIN; ... ROLLBACK; first to verify, then BEGIN; ... COMMIT;.

Scope and limits

Read-only by default. No fix is ever applied without you running the SQL.
Cannot revoke `supabase_admin` default privileges via the Management API (Postgres permission limit). The audit reports this and points to the Dashboard toggle (Project Settings → Data API → "Automatically expose new tables" = OFF).
No false-positive suppression for app APIs. A get_dashboard_stats() function intentionally exposed to anon will still appear as a high finding — exposed code paths are the surface area; you decide if intentional.
Storage scan covers buckets only. Per-object RLS is not audited (would require iterating every object).

Why another Supabase scanner?

Most existing tools (SupaExplorer, AuditYourApp, Vibe App Scanner) are SaaS — your project ref + URL go to a third party. This skill runs locally with your own PAT. The only network calls are to api.supabase.com. Audit it: see scripts/audit.js, ~250 lines of plain Node.

License

MIT — see LICENSE.