yoanbernabeu/supabase-pentest-skills
25 skills6k installsGitHub
Install
npx skills add https://github.com/yoanbernabeu/supabase-pentest-skillsSkills in this repo
1Supabase Audit RlsSupabase-audit-rls is a security skill that tests whether Row Level Security policies on a Supabase database are correctly preventing unauthorized data access. It is part of a 24-skill professional pentest toolkit designed for authorized self-assessment by development teams. Builders use it before shipping to confirm their RLS configuration actually blocks the access patterns it is meant to prevent.513installs2Supabase PentestSupabase-pentest is a Claude Code skill that acts as a security audit orchestrator for Supabase database deployments. It supports multi-phase penetration testing with Plan Mode for structured audit organization and provides enhanced traceability throughout the assessment. Solo builders and security-conscious developers use it before shipping to validate that their Supabase backend is free from common vulnerabilities and misconfigurations.340installs3Supabase Audit Functionssupabase-audit-functions is a security skill that automatically discovers and penetration-tests Supabase Edge Functions for vulnerabilities including unauthorized access and logic flaws. It maintains real-time audit logs and structured JSON context files throughout testing. Solo builders and security engineers reach for it when preparing a Supabase project for production and needing confidence that serverless functions are not publicly exploitable.271installs4Supabase Audit Auth ConfigSupabase-audit-auth-config is a Claude Code skill that performs focused security analysis of Supabase project authentication configurations, identifying misconfigurations and potential vulnerabilities. It progressively saves findings to context files during analysis to ensure no results are lost if the process is interrupted. Developers building Supabase-backed apps use it as part of a pre-launch security review to validate that auth settings follow security best practices.265installs5Supabase Helpsupabase-help is the reference and onboarding skill for the supabase-pentest-skills suite, providing a quick guide to all 24 available security audit skills. It helps builders understand which skill to invoke for a specific test scenario — from authentication audits to Edge Function security — and includes usage examples for launching full guided assessments. Solo builders and security engineers reach for it first when starting a Supabase penetration testing engagement to orient themselves in the toolkit.260installs6Supabase Audit Realtimesupabase-audit-realtime is a security skill that systematically audits Supabase Realtime WebSocket channels for vulnerabilities and misconfigurations. It enforces progressive logging of findings to context files as tests run, ensuring no discovered issues are lost if the process is interrupted. Solo builders and security professionals reach for this skill when they need to verify their Supabase Realtime setup is secure before shipping to production.256installs7Supabase Audit Rpcsupabase-audit-rpc is a security skill that discovers and penetration-tests PostgreSQL functions exposed via the Supabase RPC endpoint. It evaluates each function for authentication and authorization weaknesses, logging findings progressively to persist results even if interrupted. Reach for this skill when you need to verify that no sensitive database functions are unintentionally accessible through your Supabase RPC interface before going to production.255installs8Supabase Reportsupabase-report is the reporting skill in the yoanbernabeu supabase-pentest-skills suite, generating a structured Markdown document that consolidates all security findings collected during a Supabase penetration test. Solo builders and security engineers use it as the final step after running audit and reconnaissance skills to produce a shareable, actionable vulnerability report. It writes report sections progressively to ensure partial progress is saved even if execution is interrupted.242installs9Supabase Audit Tables Readsupabase-audit-tables-read is a penetration testing skill that attempts to read data from Supabase tables to reveal what information is accessible without proper authorization. It is part of the yoanbernabeu supabase-pentest-skills suite and is used by solo builders and security engineers to verify Row Level Security policies are correctly configured before shipping a Supabase-backed application. Findings are written progressively to context files so partial results are never lost if execution is interrupted.240installs10Supabase Detectsupabase-detect is an AI security skill that identifies whether a target web application uses Supabase as its backend infrastructure. It is the recommended first step in the 24-skill Supabase penetration testing workflow, progressively logging findings to structured context and audit files. A solo builder or security auditor reaches for it at the start of any Supabase security assessment to confirm the platform before running deeper audit skills.240installs11Supabase Extract Anon Keysupabase-extract-anon-key locates and extracts the Supabase anonymous public API key from client-side code, verifying that only the low-privilege anon key is exposed rather than the privileged service_role key. It logs findings progressively and feeds extracted credentials into subsequent audit steps. Solo builders use it as an early-stage security check to confirm proper key segregation before their Supabase app ships.239installs12Supabase Extract Service Keysupabase-extract-service-key scans client-side code to detect whether the privileged Supabase service_role key has been accidentally exposed, which would give attackers full admin access to your database. It emphasizes progressive logging of findings. Solo builders use it as a mandatory pre-ship check to ensure they have not committed an admin secret to their frontend bundle or public repository.239installs13Supabase Extract Db Stringsupabase-extract-db-string is an AI security skill that scans Supabase application code for accidentally exposed PostgreSQL database connection strings in client-side files. It progressively logs findings to structured pentest context and audit log files. A solo builder or security auditor reaches for it during pre-production security reviews to ensure database credentials have not leaked into frontend bundles.237installs14Supabase Audit Auth Userssupabase-audit-auth-users probes Supabase authentication endpoints to determine whether an attacker could enumerate valid user accounts or email addresses based on response differences. It logs findings incrementally to prevent data loss on interruption. Solo builders use it during pre-ship security review to ensure their auth layer does not inadvertently leak user existence information.236installs15Supabase Audit Buckets Listsupabase-audit-buckets-list performs automated discovery and enumeration of all storage buckets configured in a Supabase project, serving as a reconnaissance step before deeper bucket access testing. Findings are logged progressively to a JSON context file and audit log. Solo builders use it at the start of a storage security review to map out all buckets that need further permission testing.236installs16Supabase Audit Tables Listsupabase-audit-tables-list is an AI security skill that enumerates all database tables accessible through the Supabase PostgREST API endpoint. It progressively logs discoveries to structured pentest context and audit files. A solo builder or security auditor reaches for it during pre-production security audits to map the exposed database surface area before testing Row Level Security and RPC permissions.236installs17Supabase Extract Jwtsupabase-extract-jwt identifies and analyzes JSON Web Tokens related to Supabase in client-side code, flagging any that are improperly exposed or misconfigured during a security assessment. It logs findings incrementally so no discoveries are lost. Solo builders use it as part of a Supabase pentest workflow to ensure JWT secrets are properly protected and not leaked to the frontend.235installs18Supabase Report Comparesupabase-report-compare takes two Supabase security audit reports in Markdown format and performs a side-by-side analysis to show what vulnerabilities were fixed, which remain open, and whether new issues appeared. It is part of the supabase-pentest-skills suite. Solo builders use it after remediating findings from an earlier audit to verify progress and demonstrate measurable security improvement.235installs19Supabase Audit Buckets Readsupabase-audit-buckets-read validates Supabase storage bucket security by actively attempting to read files within each bucket, verifying that access controls actually block unauthorized reads. It updates audit logs after each bucket test. Solo builders use it after enumeration to confirm that misconfigured permissions cannot be exploited to access private files before their app goes live.234installs20Supabase Audit Auth Signupsupabase-audit-auth-signup performs security testing on the Supabase user registration flow, checking for vulnerabilities and misconfigurations in signup endpoints and related auth logic. Findings are written progressively to preserve them if execution is interrupted. Solo builders use it before launching their app to ensure the user registration flow cannot be abused or bypassed.231installs21Supabase Audit Buckets Publicsupabase-audit-buckets-public scans Supabase storage bucket configurations to identify buckets incorrectly set to public access, flagging potential data exposure before your app ships. It writes findings progressively to audit logs so no discoveries are lost if execution is interrupted. Solo builders use it when hardening their Supabase backend before launch to ensure private files are not inadvertently world-readable.231installs22Supabase Extract Urlsupabase-extract-url scans web application client-side code to locate and extract the Supabase project URL, giving security testers the exact API base URL they need for further vulnerability assessment. It is the reconnaissance entry point of the yoanbernabeu supabase-pentest-skills suite and is typically the first skill invoked when auditing a Supabase-backed application. Results are logged progressively to a context file to preserve partial findings.228installs23Supabase Audit Authenticatedsupabase-audit-authenticated creates a test user account and establishes an authenticated Supabase session to probe for Insecure Direct Object Reference (IDOR) flaws and other vulnerabilities that only exist for logged-in users. It compares authenticated versus anonymous access to surface privilege escalation issues. Solo builders use it as an advanced security check before launch to ensure authenticated users cannot access data belonging to other users.206installs24Supabase Evidencesupabase-evidence is a Claude Code skill for ai & agent building. It helps solo builders move faster with AI-assisted coding.60installs25Supabasesupabase is a Claude Code skill for ai & agent building. It helps solo builders move faster with AI-assisted coding.1installs