Individual skill
supabase-grants-check
Check Supabase migrations for the security side of the 30 Oct 2026 Data API grants change (Supabase's changelog schedules it) - GRANT ALL or write grants to anon, grants on tables with RLS off, policies whose role has no grant (42501), grants with no policy, SECURITY DEFINER functions anon can execute, default privileges that still auto-grant, and the local auto_expose_new_tables setting. Use when the user asks about Supabase grants, a 42501 permission-denied error, the 30 October change, or whether a GRANT fix is safe.
skills/supabase-grants-check/SKILL.md
Source commit 8a7193870ac3ea0027fb8735b48d63baf2e01f75
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- Yes
- Skill scan complete
- Yes
- Observed behavior
- Not checked yet
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 0
- Repository last updated
- Oct 17, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- claude-skills Repository topic
- claude-code Repository topic
- code-review Repository topic
- codex Repository topic
- cursor Repository topic
- nextjs Repository topic
- rls Repository topic
- security Repository topic
- skill-md Repository topic
- data Derived category
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 4,464 bytes
Read excerpt
# supabase-grants-check
Review only. Don't edit files unless the user asks for the fixes afterwards.
## Scope
Read every `.sql` file under `supabase/migrations/` in filename order (later files can fix earlier ones), plus `supabase/config.toml` if it exists. Track per table in `public` (and any other schema the user says the Data API exposes) what holds at the end of the history: RLS on or off, the policies (command and roles) and the grants per role (`anon`, `authenticated`). Treat `grant all` as select, insert, update, delete, truncate, references and trigger. Treat `revoke` as removing privileges. Dashboard changes aren't in these files, so say that in the report instead of guessing. If the user can run SQL, point them to the free SQL checker on the live database. It checks the same things, and its C1–C7 ids match G1–G7 here.
## Checks
For each finding, give file:line, the id, severity and the fix.
| Id | Severity | Look for | Fix |
|---|---|---|---|
| G1 | critical | A table where `anon` or `authenticated` has any grant and RLS is never enabled | In one migration: `enable row level security`, add policies, then keep only the minimum grant. |
| G2 | high | `anon` holds insert, update, delete or truncate on a table (including through `grant all ... to anon`) | Revoke the writes from `anon`, for example `revoke insert, update, delete, truncate on public.t from anon;`. Signed-out visitors usually need `select` at most. |