branch-isolation
Checks database queries and API routing for multi-tenant isolation. Prevents data leakage by enforcing tenant-scoped filtering.
Install
mkdir -p .claude/skills/branch-isolation && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/13801" && unzip -o skill.zip -d .claude/skills/branch-isolation && rm skill.zipInstalls to .claude/skills/branch-isolation
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Expert review of multi-tenant and branch isolation safety, ensuring no query data leaks or cross-tenant access.Key capabilities
- →Review code for query isolation filtering by tenant ID
- →Validate middleware for tenancy identifier enforcement
- →Disallow unscoped queries in database helper functions by default
- →Identify high-risk changes to multi-tenant isolation logic
- →Flag modifications to tenant resolving middleware for human review
- →Reject rationalizations for bypassing isolation rules
How it works
The skill applies isolation rules to check database queries and API routing for tenant ID filtering and middleware validation. It flags high-risk changes for human review and rejects common rationalizations for bypassing isolation.
Inputs & outputs
When to use branch-isolation
- →Reviewing SQL queries for missing tenant filters
- →Validating tenant-resolving middleware
- →Auditing API routing for security leaks
About this skill
Multi-Tenant & Branch Isolation
Expert guidelines to check that database queries and API routing enforce tenancy isolation. Every multi-tenant resource check-in, search, transaction, or update must be correctly scoped.
🛡️ Isolation Rules
- Query Isolation Filtering: All queries against tenant-scoped tables must explicitly filter by tenant ID / branch ID. Queries missing this scope pose a severe data-leakage risk.
- Middleware Validation: Tenancy identifiers passed via request headers or session cookies must be validated by middleware early in the request lifecycle. Avoid trusting a tenant identifier supplied in the body parameter of a request without validation.
- Fail-Closed Queries: In database helper functions and base repositories, assume isolation by default. Unscoped queries should be disallowed unless they match explicitly documented global exemptions.
⚠️ High-Risk Escalation Triggers
[!WARNING] Modifying multi-tenant isolation logic, tenant resolving middleware, or global scope bypass rules are high-risk changes. In accordance with
governance.md §2, any commit that modifies these patterns must trigger an escalation for mandatory human review.
🚫 Rationalisations to Reject (Anti-Rationalisation)
| Excuse / Rationalisation | Why it fails / Rebuttal |
|---|---|
| "We filter by tenant ID in the UI, so the API query doesn't need to duplicate it." | UI filters can be easily bypassed by direct API calls. All backend queries must enforce isolation. |
| "This is a super-admin operation, so we can ignore multi-tenant filters here." | Super-admins must still route queries through explicit system boundaries or validated admin endpoints. |
| "I'll add the database filter in the service layer next time, let's merge the repository change first." | Never allow unscoped database queries to enter the repository layer, even temporarily. |
When not to use it
- →When the system is not multi-tenant
- →When the goal is not to ensure branch isolation safety
- →When the changes are not related to database queries or API routing
Limitations
- →All queries against tenant-scoped tables must explicitly filter by tenant ID / branch ID.
- →Tenancy identifiers passed via request headers or session cookies must be validated by middleware.
- →Unscoped queries should be disallowed unless they match explicitly documented global exemptions.
How it compares
This skill provides expert guidelines and specific rules for enforcing multi-tenant isolation, proactively identifying high-risk changes and rejecting common excuses for security vulnerabilities, which is more rigorous than a general code r
Compared to similar skills
branch-isolation side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| branch-isolation (this skill) | 0 | 1mo | No flags | Advanced |
| supabase-rls-policy-generator | 11 | 9mo | No flags | Advanced |
| sqlmap-database-penetration-testing | 4 | 6mo | Review | Advanced |
| data-safety-auditor | 3 | 7mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by Peadarpol
View all by Peadarpol →You might also like
supabase-rls-policy-generator
hopeoverture
This skill should be used when the user requests to generate, create, or add Row-Level Security (RLS) policies for Supabase databases in multi-tenant or role-based applications. It generates comprehensive RLS policies using auth.uid(), auth.jwt() claims, and role-based access patterns. Trigger terms include RLS, row level security, supabase security, generate policies, auth policies, multi-tenant security, role-based access, database security policies, supabase permissions, tenant isolation.
sqlmap-database-penetration-testing
davila7
This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and columns from a vulnerable database," or "perform automated database penetration testing." It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.
data-safety-auditor
ananddtyagi
Comprehensive data safety auditor for Vue 3 + Pinia + IndexedDB + PouchDB applications. Detects data loss risks, sync issues, race conditions, and browser-specific vulnerabilities with actionable remediation guidance.
row-level-security
dadbodgeoff
Implement PostgreSQL Row Level Security (RLS) for multi-tenant SaaS applications. Use when building apps where users should only see their own data, or when implementing organization-based data isolation.
supabase-data-handling
jeremylongshore
Implement Supabase PII handling, data retention, and GDPR/CCPA compliance patterns. Use when handling sensitive data, implementing data redaction, configuring retention policies, or ensuring compliance with privacy regulations for Supabase integrations. Trigger with phrases like "supabase data", "supabase PII", "supabase GDPR", "supabase data retention", "supabase privacy", "supabase CCPA".
supabase-postgres-best-practices
davila7
Postgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or database configurations.