supabase-owasp-auditlisted

Rigorous OWASP-aligned security audit of a Supabase-backed app, combining static repo review with live database inspection (RLS, policies, grants, advisors, storage, auth). Use whenever the user wants to analyze, audit, or review the security of an app using Supabase — especially if they mention OWASP, RLS, "security score", vulnerabilities, "is my app secure", edge functions, leaked keys, or provide a repo ZIP plus a connected Supabase project. Produces a first report IN CHAT: a textual situation report, a 0–10 score per OWASP Top 10 category as wireframes, and wireframes for app structure, strong points, weak points, and the correction pipeline (plus extras as warranted) — then offers a Markdown audit report and remediation plan. Trigger even if the user just says "audit my app" or "check my Supabase security".
thiagoferal-ia/thiago-feral-skills · ★ 0 · Data & Documents · score 70

Install: claude install-skill thiagoferal-ia/thiago-feral-skills

# Supabase OWASP Security Audit This skill turns a connected Supabase project plus a repository into a precise, OWASP-aligned security audit. The deliverable is a layered, visual report presented in the chat first, followed by two optional Markdown files. The goal is an analysis any reader can follow — technical or not — backed by evidence from both the code and the live database. ## What makes this audit trustworthy - **Two sources, cross-checked.** Static code review finds intent (hardcoded secrets, missing auth, unsigned webhooks); the live database shows reality (which role can actually read which table right now). A finding is strongest when both agree. Migrations are cumulative and can lie about the final state — always confirm against the live database. - **Latest OWASP, fetched at run time.** Do not assume the edition from memory. The current edition is OWASP Top 10:2025; still verify (see Phase 0). - **Evidence over assertion.** Every finding cites the file/line or the exact query result behind it. - **Honest scoring.** A transparent rubric (`references/scoring.md`), never a number pulled from thin air. ## Inputs & prerequisites Confirm these with the user before starting. The first two are mandatory; the rest sharpen accuracy and prevent over/under-stating severity. **Required** 1. **Supabase connected to Claude** (MCP). The skill needs `get_advisors`, `execute_sql`, and `list_tables`. Confirm the exact `project_id` and that it is the **production**