본문으로 건너뛰기
cccskills
무료GitHub에 공개

supabase-sentinel

Audit any Supabase project for security vulnerabilities, RLS misconfigurations, exposed API keys, auth bypasses, and storage issues. Use this skill whenever the user mentions Supabase security, RLS policies, database security audit, security review, penetration testing a Supabase app, checking if their database is exposed, hardening their Supabase project, fixing RLS, or anything related to securing a Supabase or vibe-coded application. Also trigger when the user asks about securing apps built with Lovable, Bolt, Replit, Cursor, or any AI coding tool that uses Supabase as a backend. Even if the user just says 'is my app secure' or 'check my database' and their project uses Supabase, use this skill. (DEPRECATED: this skill is a backwards-compat shim. Prefer the multi-backend `database-sentinel` skill, which covers Supabase plus Firebase, MongoDB, self-hosted Postgres, and self-hosted MySQL.)

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Farenhytee/database-sentinel
연동 도구FirebaseSupabasePostgreSQLMySQLMongoDB
설치 방법 보기

포함된 파일(1)

  • SKILL.md3.8 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Supabase Sentinel — backwards-compat shim

DEPRECATED. This skill exists only to preserve the original supabase-sentinel trigger surface for users who installed it before the multi-backend rename. New audits should use the database-sentinel skill (one level up at the repo root), which handles Supabase identically and adds Firebase, MongoDB, self-hosted Postgres, and self-hosted MySQL.

Sunset date: TBD — keep at minimum through the next minor release of Database Sentinel. After that, this stub will be removed and supabase-sentinel will resolve to the multi-backend skill via skill-name aliasing.

What this shim does

When invoked, this skill:

  1. Loads the parent database-sentinel skill's workflow.
  2. Forces the audit to Supabase only — even if other backends are detected in the working directory, only the Supabase audit runs.
  3. Behaves identically to the v1 Supabase Sentinel: same 7-step workflow, same 27 anti-patterns (SB-001..SB-027), same fix templates, same CI workflow template.

How to invoke

Same as before — say things like:

  • "Audit my Supabase project for security issues"
  • "Is my Supabase database exposed?"
  • "Check my RLS policies"
  • "Run a security review of this Supabase app"

The shim will dispatch to the multi-backend database-sentinel skill with backend=supabase pinned.

Behavior contract

The shim must:

  • Run the same 7-step workflow as the v1 Supabase Sentinel.
  • Produce a report indistinguishable from the v1 output (same scoring, same finding format, same Passing section, same footer).
  • Reference the same files: ../../backends/supabase/workflow.md, ../../backends/supabase/anti-patterns.md, ../../backends/supabase/audit-queries.md, ../../backends/supabase/fix-templates.md, ../../assets/ci/github-action-supabase.yml.
  • Skip detection of other backends (the user invoked the Supabase-specific skill explicitly).

The shim must not:

  • Audit Firebase, MongoDB, or self-hosted SQL backends, even if signals are present.
  • Emit a "cross-backend interactions" section (single-backend mode only).
  • Mention the rename in the report itself unless the user asks how to migrate. The deprecation notice belongs in tool output / changelog, not in the user-facing audit report.

Migration

Users who want multi-backend coverage should invoke database-sentinel instead — same triggers, broader coverage. No project changes are needed; detection picks up the additional backends automatically.

If only Supabase is in use, database-sentinel and supabase-sentinel produce identical output. The rename is purely about expanding the trigger surface.

Implementation pointer

The actual workflow lives at ../../backends/supabase/workflow.md. This file is intentionally thin — it exists so the supabase-sentinel skill name continues to resolve until the deprecation window closes.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

database-sentinel

무료

Multi-backend database security auditor. Audits Supabase, Firebase (Firestore/RTDB/Storage/Functions/Remote Config), MongoDB (self-hosted + Atlas), self-hosted PostgreSQL, and self-hosted MySQL for RLS/rules misconfigurations, exposed credentials, auth bypasses, MongoBleed (CVE-2025-14847), pgBouncer CVE-2025-12819, mysql_native_password drift, ghost auth, and storage exposures. Use this skill whenever the user mentions database security, RLS or rule audits, security review, penetration testing a vibe-coded app, checking if their DB is exposed, hardening a backend, fixing security rules, or auditing apps built with Lovable/Bolt/Replit/Cursor/Claude Code on any of these backends. Trigger on phrases like 'is my app secure', 'check my database', 'audit my Firebase', 'audit my MongoDB', 'audit my Postgres', 'audit my Supabase', 'is my DB exposed', or any cross-backend variant ('audit my full stack').

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Farenhytee/database-sentinel502026년 10월 6일 업데이트

Farenhytee의 스킬 모두 보기

이 스킬의 문제 신고