Security Audit
This skill performs a comprehensive security audit, detecting secrets, static analysis issues, and Supabase Row-Level Security misconfigurations. It autonomously applies fixes and re-runs scans until all findings are resolved.
What it does
The skill utilizes Gitleaks for secret detection and Semgrep for static application security testing. It inspects Supabase migrations for correct Row-Level Security configurations, verifying RLS is enabled and policies exist for tables. It also checks for tracked environment files and scans for hardcoded API keys. Upon finding vulnerabilities, the skill automatically remediates them by replacing secrets, removing tracked configuration files, and generating RLS policies. It then re-scans the project, iterating on fixes until clean.
When it fits
-
When integrating new code or dependencies, requiring automated checks for common security vulnerabilities.
-
When preparing a project for deployment, needing final verification for no secrets or obvious security misconfigurations.
-
When maintaining a Supabase project, ensuring Row-Level Security is correctly implemented.
Setup
-
Copy the skill definition file to
.claude/skills/security-audit/SKILL.mdin the project repository. -
Invoke the skill in Claude Code by entering
/security-auditin the chat interface.
The content
Security Audit
Run a comprehensive security audit on this project. Fix all findings autonomously.
Current git status: !git status --short
Supabase project: !ls supabase/migrations/ 2>/dev/null | tail -5 || echo "No supabase directory"
Step 1: Run Scanners
Run all applicable scanners:
# Secret scanning
gitleaks detect --source . --no-git --report-format json --report-path /tmp/gitleaks-report.json 2>&1 || true
# SAST
semgrep --config=auto --json --output /tmp/semgrep-report.json . 2>&1 || true
Read both report files and understand all findings.
Step 2: Check Supabase RLS
If supabase/migrations/ exists:
- Read all migration files
- For every
CREATE TABLEinpublicschema, verify RLS is enabled and at least one policy exists - Flag missing RLS
Step 3: Check Environment Files
- Verify
.envand.env.*(except.env.example) are in.gitignore - Run
git ls-files | grep '\.env'to find tracked env files (exclude .env.example and vite-env.d.ts) - Scan
src/for hardcoded API keys or tokens
Step 4: Fix All Findings
For each finding:
- Secrets in code: Replace with env var reference, add to
.env.example - Tracked .env files:
git rm --cached - SAST issues: Apply semgrep's recommended fix
- Missing RLS: Generate migration file with RLS + basic policy
Step 5: Re-run Until Clean
Re-run all scanners from Step 1. If findings remain, fix and repeat. Stop after 3 cycles or when clean.
Step 6: Summary
Output what was found, what was fixed, and final scan status.
Served straight from the framework this site runs on. This page always shows the current version.