What It Is For
Row level security, or RLS, decides which rows each user can see in a Supabase database. The trouble is that it fails quietly. The migration runs. The screen looks right. And someone can still read rows they should never see.
This skill tells an AI agent how to check if RLS is really doing its job. Its rule is short: ask the database what is true, then test it as a real user. Never grade a policy by reading the SQL that made it.
Who Should Use It
Anyone who runs an app on Supabase or Postgres and uses RLS to keep data apart. Load it when you:
- add a view or a security definer function
- get a table flagged by the security advisor
- want to know if the public anon key can read something
- are about to ship a change that claims to lock data down
- wrote a policy that nobody tested as a real signed in user
How Clickflame Built It
Clickflame wrote this skill from production incidents on a live Supabase app with many tenants. The skill says every finding in it came from a running database whose migrations looked like they had already handled the problem.
The repo's README gives some of the numbers. One view sent 2,028 rows of money data to the public key. In one project, 48 of 53 security definer functions could be called with the public key, across 85 migrations that all read correctly. Seven backup tables of names, phones and emails could be read with the site's own key.
None of those threw an error. Each was found by asking the database, not by reading the code.
What It Checks
- Which tables and views the public anon role can read, and whether anything stands in the way
- Views that skip RLS because they run as their owner
- Grants that add access when they look like they limit it
- Tables made with create table as, which start with RLS off
- Permissive policies that combine with OR, so tightening one does nothing
- Sweeps that match a policy by name and miss the one named differently
- Slow queries where an index cannot help, because the lookup sits inside a policy
It ships with a read only SQL script, rls_audit.sql, that runs six checks. The README says it is safe to run on production. The skill also shows how to test as a real signed in user, and how to write up each finding with its proof, its fix and what the fix might break.
How to Install It
Run this in your terminal. It adds this skill for your AI coding agent:
npx skills add halltony85-source/clickflame-agent-skills@supabase-rls-audit -g -yOr add all four Clickflame skills at once:
npx skills add halltony85-source/clickflame-agent-skills -g -yThen start a new session. The agent loads the skill when a task matches it. New to skills? Start with what an agent skill is.
See It on GitHub
The full skill is free to read before you install it. Read Supabase RLS Audit on GitHub. It is part of Clickflame's agent skills repo, under the MIT license.