Skills — PolicyCheck

Individual Skills

Deep-dive into a specific security area

Finds tables missing Row Level Security. Every table without RLS is fully accessible to anyone with your anon key.

Checks: Tables with RLS disabled, tables with RLS but no policies (blocks all access), full RLS status overview

Trigger phrases: "check RLS", "are my tables secure", "find unprotected tables"

Reviews existing RLS policies for gaps and misconfigurations. Catches USING (true) on write operations and other dangerous patterns.

Checks: Permissive write policies, dangerous WITH CHECK clauses, tables with RLS but no policies, policy command analysis

Trigger phrases: "review my policies", "check RLS policies", "find permissive policies", "why can anon write to my table"

Finds exposed sensitive columns like passwords, tokens, API keys, SSNs, and credit card numbers in tables accessible via the REST API.

Checks: Password/secret/token columns, API key columns, PII (SSN, financial), crypto material (salts, hashes), anon access to sensitive data

Trigger phrases: "check for PII", "sensitive data exposed", "are passwords visible", "audit column security"

Audits storage buckets for public access, missing policies, and upload restrictions. Public buckets expose all files to the internet.

Checks: Public flag status, file size limits, MIME type restrictions, buckets with no storage policies

Trigger phrases: "check storage security", "are my buckets public", "audit file uploads", "storage bucket exposed"

Audits RPC functions for anon access, SECURITY DEFINER issues, and missing search_path configuration — a critical privilege escalation vector.

Checks: Anon-callable functions, SECURITY DEFINER without search_path, destructive functions (delete/drop/truncate) callable by anon

Trigger phrases: "check my functions", "which functions can anon call", "audit RPC security", "SECURITY DEFINER risk"

Reviews the overall API attack surface — how many tables are exposed, how much data is accessible, and what permissions the anon role has.

Checks: Exposed table count, anon role grants (SELECT/INSERT/UPDATE/DELETE), tables with 10k+ rows, overall attack surface summary

Trigger phrases: "how much is exposed", "audit API surface", "what can anon access", "too many tables visible"

Audits authentication configuration including unconfirmed accounts, MFA adoption rate, auth hook security, and service_role usage in policies.

Checks: Unconfirmed user count, MFA adoption, auth hook functions callable by anon, service_role references in policies

Trigger phrases: "check auth security", "MFA adoption", "unconfirmed users", "audit authentication"

Audits Realtime subscriptions for data leaks. Tables broadcasting changes without RLS let anyone subscribe and watch all data flow in real time.

Checks: Tables in Realtime without RLS, missing SELECT policies on Realtime tables, sensitive columns in Realtime tables

Trigger phrases: "check Realtime security", "who can see my Realtime data", "audit subscriptions", "Realtime leaking data"