Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsSupabase Role Isolation Gate
Maps app roles to Supabase RLS policies and creates cross-user and cross-tenant access tests.
$9.99
Supabase Role Isolation Gate
Example session with this skill installed
Review this fictional Supabase app before launch. Roles: volunteer and coordinator. Volunteers should read only their own assigned records. Coordinators should read records in their own region only. Current schema has profiles(id, role, region_id), assignments(user_id, record_id), records(id, region_id, owner_id). RLS is enabled on records, but the SELECT policy is USING (true). UPDATE policy and RPC functions were not supplied. Identify confirmed risks, unknowns, and the smallest useful negative test set. Do not connect to a live project or run SQL.
- Read your context and instructions
- Compiled the supabase role isolation
Result: BLOCK for authenticated SELECT
The supplied policy USING (true) permits every authenticated row covered by the policy unless another restrictive policy or database boundary changes the result. No such boundary was supplied, so cross-user and cross-region reads must be treated as exposed in this review.
| Check | Result | Evidence / next step |
|---|---|---|
| Volunteer reads own assigned record | UNKNOWN | Assignment join and intended policy were not supplied. Test with two users. |
| Volunteer reads another volunteer’s record | BLOCK | Broad SELECT predicate does not restrict rows in the supplied policy. |
| Coordinator reads own region | UNKNOWN | Region claim/profile mapping is not shown. Verify trusted source of region_id. |
| Coordinator reads another region | BLOCK | No region boundary appears in the supplied SELECT policy. |
| UPDATE behavior | UNKNOWN | UPDATE policy and column constraints were not supplied. |
| RPC / service-role paths | UNKNOWN | Function definitions and server-side callers are outside this evidence. |
Safe next steps
- Replace the broad policy with a reviewed predicate tied to trusted user identity and assignment/region membership.
- Add tests for unauthenticated access, volunteer A reading volunteer B’s row, coordinator A reading region B, and allowed same-user/same-region reads.
- Test UPDATE separately with both
USINGandWITH CHECK; include attempts to change owner or region fields. - Inspect RPCs, views, Storage rules, and service-role code before release.
This is a static review of fictional inputs. No database was accessed, no SQL was executed, and the result is not a security certification.
Connects securely to your tools. The creator never sees your data.
About this skill
A practical authorization preflight for multi-role Supabase apps. It traces workflows to database-level rules, flags missing or broad Row Level Security, and produces tests for both allowed and forbidden reads and writes. Remediation SQL is a proposal for review.
See it in action: Given a fictional volunteer app where coordinators should see only their own segment, this skill identifies a broad SELECT policy, marks cross-segment access BLOCK, and returns negative tests for a second segment's records.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 4 days ago
Requires