yoanbernabeu/supabase-pentest-skills
24 skills8k installs1.4k starsGitHub
Install
npx skills add https://github.com/yoanbernabeu/supabase-pentest-skillsSkills in this repo
1Supabase Audit Rlssupabase-audit-rls from yoanbernabeu/supabase-pentest-skills audits Supabase Row Level Security before production deploys. It exercises policies for common bypass paths and misconfigurations, mandating progressive file updates: each finding lands immediately in .sb-pentest-context.json while .sb-pentest-audit.log records activity before and after every test so interrupted runs retain evidence. Developers reach for supabase-audit-rls when Postgres RLS is enabled but untested, or when agents need a repeatable security checklist instead of manual SQL spot checks. Failure to write findings progressively is treated as a critical skill error, reflecting the high stakes of silent data exposure.662installs2Supabase Pentestsupabase-pentest is a Supabase security audit orchestrator from yoanbernabeu/supabase-pentest-skills that guides agents through eight sequential phases: initialization, detection, key extraction, API audit, storage audit, auth audit, realtime and functions audit, and report generation. The repo bundles 24 specialized audit skills covering anon/service key extraction, RLS checks, bucket exposure, auth signup flows, and Edge Functions review. Each phase requires updating .sb-pentest-context.json, .sb-pentest-audit.log, timeline.md, curl-commands.sh, and .sb-pentest-evidence/ before proceeding. Plan Mode is recommended at start so developers confirm scope and ownership. Reach for supabase-pentest when auditing a Supabase-backed production app and you need checkpointed, reproducible pentest evidence instead of ad hoc curl probes.452installs3Supabase Audit Functionssupabase-audit-functions is a Supabase pentest skill from yoanbernabeu/supabase-pentest-skills for developers security-testing Edge Functions before production launch. The skill discovers all exposed Supabase Edge Functions in a project, tests each for security vulnerabilities and misconfigurations, and mandates progressive writes to `.sb-pentest-context.json` and `.sb-pentest-audit.log` after every function tested so interrupted runs retain findings. Developers reach for supabase-audit-functions during pre-release hardening or authorized penetration tests of Supabase backends. The workflow emphasizes immediate persistence rather than end-of-run dumps, preventing data loss if the agent crashes mid-audit. Use it when Edge Function attack surface must be enumerated and validated with structured evidence. Skip it for non-Supabase stacks, unauthorized targets, or teams needing only RLS policy review without function testing.354installs4Supabase Audit Auth Configsupabase-audit-auth-config is a security audit skill from yoanbernabeu/supabase-pentest-skills that analyzes Supabase project authentication settings for weaknesses and misconfigurations. Unlike one-shot reports, it mandates progressive file updates: each analyzed setting is written immediately to .sb-pentest-context.json and logged before and after every test in .sb-pentest-audit.log so interrupted runs still preserve prior findings. Developers reach for it during pre-production Supabase hardening, compliance checks, or pentest prep when auth flows, provider settings, or session policies need structured review. The skill is procedural—an agent follows its checklist against live project config rather than shipping code. It pairs with other supabase-pentest-skills for broader surface coverage beyond auth alone.352installs5Supabase Helpsupabase-help is the entry-point skill in yoanbernabeu/supabase-pentest-skills, a collection of 24 Supabase security audit skills. It gives developers a quick reference to every audit skill, command overview, and usage examples when planning or running Supabase penetration tests. Quick-start commands include /supabase-pentest for a full guided audit, /supabase-detect to verify whether an app uses Supabase, and /supabase-report to generate findings from a prior run. Developers reach for supabase-help when they need to pick the right audit skill from the suite or learn command syntax before testing a Supabase-backed SaaS or API. The skill orchestrates the broader pentest workflow rather than executing a single deep check itself.346installs6Supabase Audit Realtimesupabase-audit-realtime is a penetration-testing skill from yoanbernabeu/supabase-pentest-skills that exercises Supabase Realtime WebSocket channels to detect unauthorized subscriptions, leaked row data, and channel policy misconfigurations. The skill mandates progressive writes to `.sb-pentest-context.json` after each channel tested and `.sb-pentest-audit.log` before and after every subscription attempt so interrupted runs retain partial findings. Developers reach for supabase-audit-realtime when auditing staging or production Supabase projects that expose Realtime channels to browsers or mobile clients, especially after RLS changes, new channel topics, or before a security review. The workflow targets subscription authorization boundaries rather than general API fuzzing or database schema review.345installs7Supabase Audit Rpcsupabase-audit-rpc is a pentest skill from yoanbernabeu/supabase-pentest-skills for developers securing Supabase-backed applications. The skill lists exposed PostgreSQL RPC functions and tests them for security issues including authentication gaps, authorization flaws, and potential RLS bypass. Progressive file updates are mandatory: findings write to .sb-pentest-context.json immediately after each function test and .sb-pentest-audit.log before and after each test so interrupted runs retain prior results. Developers reach for supabase-audit-rpc during pre-ship security review of Supabase RPC surfaces.341installs8Supabase Reportsupabase-report is a yoanbernabeu/supabase-pentest-skills agent skill that turns collected Supabase penetration-test evidence into shareable Markdown documentation. It reads findings from .sb-pentest-context.json, progressively logs each section to .sb-pentest-audit.log, and outputs supabase-audit-report.md with eight structured sections: Executive Summary, Security Score, Critical P0 findings, High P1 findings, Medium P2 findings, Detailed Analysis by component, Remediation Plan, and Appendix methodology notes. Developers invoke supabase-report after running detection, extraction, and audit skills in the 24-skill Supabase Pentest toolkit when stakeholders need quantified risk scores, proof-of-concept examples, and phased remediation owners. Progressive file writes are mandatory so partial reports survive interrupted runs. The skill suits security engineers and backend leads documenting exposed service_role keys, public storage buckets, RLS gaps, and Edge Function privilege issues before production launch.330installs9Supabase Extract Anon Keysupabase-extract-anon-key is a Claude skill from yoanbernabeu/supabase-pentest-skills that scans client-side code to extract the Supabase anon/public API key expected in frontend apps. The skill confirms the discovered credential is the anon key and not the privileged service_role secret, supporting Row Level Security testing before production deploys. Findings write progressively to .sb-pentest-context.json and .sb-pentest-audit.log after each discovery so interrupted runs retain state. Developers reach for supabase-extract-anon-key during Supabase pentest workflows when validating credential segregation in React, Next.js, or other client bundles. It is the first step in confirming public keys are correctly scoped for RLS validation.325installs10Supabase Audit Auth Userssupabase-audit-auth-users is an agent skill from yoanbernabeu/supabase-pentest-skills that audits Supabase authentication endpoints for user enumeration flaws. It probes whether valid email addresses can be inferred from differential responses on auth routes such as signup, login, and password recovery. The skill requires progressive file updates: write findings to .sb-pentest-context.json immediately after each endpoint test and log to .sb-pentest-audit.log before and after every probe so interrupted runs preserve evidence. Developers reach for this skill during security review of Supabase-backed applications before production launch or external pentest handoff. It fits teams validating that auth error messages, status codes, and timing do not leak account existence to attackers scanning email lists.322installs11Supabase Audit Tables Readsupabase-audit-tables-read is a read-only Supabase API audit skill from the 24-skill supabase-pentest-skills toolkit that attempts GET /rest/v1/{table}?select=* queries using an anon key after tables are listed. It supports Quick (5 rows), Sample (10 random rows), and Count (HEAD-only) modes, classifies findings as P0–P2, and progressively updates .sb-pentest-context.json and .sb-pentest-audit.log after each table tested. Developers reach for supabase-audit-tables-read when RLS policies exist on paper but you need proof of which PII, secrets, or row counts are actually retrievable without authentication. The skill auto-invokes supabase-audit-tables-list when needed and saves redacted JSON evidence under .sb-pentest-evidence/03-api-audit/data-samples/.322installs12Supabase Extract Service Keysupabase-extract-service-key is a Claude skill from yoanbernabeu/supabase-pentest-skills flagged as CRITICAL for detecting Supabase service_role key leaks in client-side code—a P0 severity issue. The skill scans JavaScript and TypeScript bundles for the admin credential that bypasses Row Level Security and must never ship in frontend assets. Findings write progressively to .sb-pentest-context.json and .sb-pentest-audit.log before and after each action so partial runs preserve evidence. Developers reach for supabase-extract-service-key during pre-deploy Supabase security reviews or CI secret-scanning gates. A positive detection should block release until the service_role key is rotated and removed from client code.322installs13Supabase Detectsupabase-detect is the first-step detection skill in yoanbernabeu/supabase-pentest-skills, a 24-skill authorized Supabase audit toolkit compatible with Claude Code, Cursor, Codex, and Windsurf. It fetches the target URL, scans HTML and JS bundles for *.supabase.co domains, @supabase/supabase-js imports, SUPABASE_URL env patterns, and characteristic endpoints like /rest/v1/, /auth/v1/, /storage/v1/, /realtime/v1/, and /functions/v1/. Findings are saved progressively to .sb-pentest-context.json with high, medium, or low confidence and logged to .sb-pentest-audit.log. Developers invoke supabase-detect before key extraction or RLS testing when the backend stack is unknown or when batch-checking multiple apps for Supabase presence.321installs14Supabase Extract Db Stringsupabase-extract-db-string is a critical skill in the yoanbernabeu supabase-pentest-skills suite that scans client bundles for PostgreSQL connection strings such as postgresql://postgres:[password]@db.[project-ref].supabase.co:5432/postgres and Supavisor pooler URLs. Exposed strings allow direct database access, full RLS bypass, schema changes, and auth.users enumeration—classified as P0 severity. The skill mandates progressive writes to .sb-pentest-context.json after each discovery and logging to .sb-pentest-audit.log before and after every action so interrupted runs preserve findings. Evidence lands under .sb-pentest-evidence/02-extraction/db-string-exposure/ with connection-details.json and location.txt. Developers reach for this skill during every Supabase security audit, pre-production code review, or when suspecting DATABASE_URL leaks in NEXT_PUBLIC_* or VITE_* environment variables bundled to the browser.321installs15Supabase Audit Buckets Publicsupabase-audit-buckets-public is a yoanbernabeu supabase-pentest-skills workflow that identifies Supabase storage buckets publicly accessible and potentially containing sensitive data. The skill requires progressive updates to .sb-pentest-context.json immediately after each bucket analysis and logging to .sb-pentest-audit.log before and after each test so partial audit state persists if a run is interrupted. Developers reach for supabase-audit-buckets-public before launching apps that store uploads, documents, or user files in Supabase Storage. The audit specifically targets bucket-level access control mistakes that leave objects readable without authentication. It complements other supabase-pentest-skills modules as a focused storage exposure check rather than a full infrastructure penetration test.319installs16Supabase Audit Tables Listsupabase-audit-tables-list is a Supabase pentest skill that discovers every database table reachable via the PostgREST API and records findings as the first database reconnaissance step in a security audit. Like its bucket counterpart, it mandates progressive writes to `.sb-pentest-context.json` after each table discovery and operation logging to `.sb-pentest-audit.log` before and after every action so crashes do not lose prior results. Developers use supabase-audit-tables-list when reviewing RLS coverage, hunting exposed tables, or building a structured Supabase attack-surface report. It fits the yoanbernabeu/supabase-pentest-skills workflow alongside bucket and policy audit skills.318installs17Supabase Audit Buckets Listsupabase-audit-buckets-list is a Supabase pentest skill that discovers every storage bucket in a project and records bucket-level configuration as the opening step of storage security reconnaissance. The skill writes findings progressively to `.sb-pentest-context.json` after each bucket is found and logs operations to `.sb-pentest-audit.log` before and after each action so interrupted runs still retain partial results. Developers reach for supabase-audit-buckets-list when auditing Supabase Storage exposure, checking for public buckets, or building a structured pentest report before tightening RLS and bucket policies. It pairs with other skills in yoanbernabeu/supabase-pentest-skills for table and policy review.317installs18Supabase Audit Buckets Readsupabase-audit-buckets-read is one storage-audit skill in yoanbernabeu/supabase-pentest-skills, a 24-skill Supabase penetration-testing toolkit for Claude Code, Cursor, and Windsurf. The skill performs read-only checks that list objects per bucket, read metadata, download small samples for content-type verification, and test public URL access while flagging sensitive filenames and secrets. Developers reach for supabase-audit-buckets-read after supabase-audit-buckets-list when validating whether anon or authenticated keys can read files that RLS should block. Execution mandates progressive writes to .sb-pentest-context.json after each bucket and .sb-pentest-audit.log before and after each file test so interrupted runs retain findings. Output includes structured evidence entries, curl-commands.sh additions, and severity-tagged storage-audit records suitable for supabase-report generation.313installs19Supabase Report Comparesupabase-report-compare is a Supabase security skill that diffs two Markdown audit reports from the same project to track remediation progress and identify regressions. Developers and security engineers run it after fixing vulnerabilities or during periodic reviews to verify that earlier findings were resolved and no new issues appeared. The skill expects two audit reports in Markdown format from the same Supabase project, accepting paths like old-report.md and new-report.md. Use supabase-report-compare when measuring security posture over time, validating a remediation sprint, or preparing evidence that vulnerabilities were addressed before shipping updates.312installs20Supabase Extract Jwtsupabase-extract-jwt is a Supabase penetration-testing skill that extracts and decodes JWT tokens found in client-side code, cookies, and local storage. The skill writes findings progressively to .sb-pentest-context.json and logs actions to .sb-pentest-audit.log so discoveries survive interruptions. Developers and security engineers use it during Supabase app assessments to identify exposed credentials, decode token payloads, and flag misconfigured authentication patterns. The skill mandates immediate context-file updates after each discovery rather than batching results at completion. Reach for supabase-extract-jwt when auditing Supabase frontends for leaked anon keys, service role tokens, or JWT claims that reveal authorization weaknesses.310installs21Supabase Extract Urlsupabase-extract-url scans web application client-side code to locate and extract the Supabase project URL, giving security testers the exact API base URL they need for further vulnerability assessment. It is the reconnaissance entry point of the yoanbernabeu supabase-pentest-skills suite and is typically the first skill invoked when auditing a Supabase-backed application. Results are logged progressively to a context file to preserve partial findings.310installs22Supabase Audit Auth Signupsupabase-audit-auth-signup is a yoanbernabeu supabase-pentest-skills workflow that tests whether Supabase user signup is open and identifies abuse vectors in the registration process. The skill mandates progressive file updates: writing findings to .sb-pentest-context.json immediately after each test and logging to .sb-pentest-audit.log before and after every test so interrupted runs retain partial results. Developers reach for supabase-audit-auth-signup before shipping apps that expose public registration endpoints on Supabase Auth. The audit focuses on signup flow misconfigurations such as unrestricted account creation paths that enable spam, enumeration, or privilege abuse. It is part of a structured Supabase pentest skill suite designed for agent-driven security reviews rather than manual browser probing alone.309installs23Supabase Audit Authenticatedsupabase-audit-authenticated creates a test user account and establishes an authenticated Supabase session to probe for Insecure Direct Object Reference (IDOR) flaws and other vulnerabilities that only exist for logged-in users. It compares authenticated versus anonymous access to surface privilege escalation issues. Solo builders use it as an advanced security check before launch to ensure authenticated users cannot access data belonging to other users.278installs24Supabase Evidencesupabase-evidence is a Claude Code skill for ai & agent building. It helps solo builders move faster with AI-assisted coding.118installs