SniffPup as an Agent Skill
A skill is a small folder of instructions your AI coding tool loads when it's useful. With the SniffPup skill installed, you can ask Claude Code, Cursor or another agent that supports skills to check your own site or Supabase project, and it knows which SniffPup check to run and how to read the results.
Install
Run this in your project. It asks which tools to add the skill to, including Claude Code and Cursor. Add -g to install it for every project.
npx skills add https://sniffpup.com/agent-skill/sniffpup-skill.tgz
Or unpack it yourself into Claude Code's skills folder (for Cursor, use ~/.cursor/skills):
mkdir -p ~/.claude/skills && curl -sL https://sniffpup.com/agent-skill/sniffpup-skill.tgz | tar -xz -C ~/.claude/skills
The skill is plain text plus one small script with no dependencies. Read it before you use it, like any skill.
What it can do
- Scan your live site. It runs the same free scan as the scan box on the home page: the score, every issue found, and every critical issue with masked evidence and fix steps. With no critical issue, one other issue comes with its fix. It uses the SniffPup MCP server if you've connected it, and otherwise calls the same free tool directly.
- Audit your Supabase project. It runs
npx sniffpup-supabase project, a read-only check of your project's security settings. Your Supabase token stays on your computer and is only sent to Supabase. - Check migrations before you run them. It runs
npx sniffpup-supabase migrations, which reads your migration files locally and flags steps that delete or rewrite data.
Try asking:
- “I own my-app.com. Scan it with SniffPup and fix anything critical.”
- “Audit my Supabase project with SniffPup.”
- “Check my new migration with SniffPup before I run it.”
What it always does
- Checks only sites and projects you own or have permission to test. Before each site scan it shows you the consent text and waits for your yes, which means you agree to the same Terms, Acceptable Use Policy and Privacy Policy as the scan box on the website.
- Reports only what SniffPup found, keeps leaked keys masked, and never runs SQL on your database. Any SQL it shows is for you to review and run.
- Has the same limits as a free scan from the website.
Fixes for every issue
The free results list every issue. Fix steps for the rest, re-scans and exports are in the Full Fix Report and the monthly plans. See pricing.