Supabase Help
- 346 installs
- 60 repo stars
- Updated January 31, 2026
- yoanbernabeu/supabase-pentest-skills
supabase-help is a Claude Code security skill that indexes all 24 Supabase pentest audit skills, maps commands like /supabase-pentest and /supabase-detect, and provides usage examples for Supabase application security te
About
supabase-help is the entry-point skill in yoanbernabeu/supabase-pentest-skills, a collection of 24 Supabase security audit skills. It gives developers a quick reference to every audit skill, command overview, and usage examples when planning or running Supabase penetration tests. Quick-start commands include /supabase-pentest for a full guided audit, /supabase-detect to verify whether an app uses Supabase, and /supabase-report to generate findings from a prior run. Developers reach for supabase-help when they need to pick the right audit skill from the suite or learn command syntax before testing a Supabase-backed SaaS or API. The skill orchestrates the broader pentest workflow rather than executing a single deep check itself.
- Quick reference for all 24 Supabase security audit skills
- Identifies the right skill for any specific audit task
- Shows usage examples for common audit scenarios
- /supabase-pentest [URL] launches a full guided audit
- /supabase-detect [URL] identifies Supabase implementation in a target
Supabase Help by the numbers
- 346 all-time installs (skills.sh)
- +13 installs in the week ending Jul 28, 2026 (Skillselion tracking)
- Ranked #586 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-helpAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 346 |
|---|---|
| repo stars | ★ 60 |
| Last updated | January 31, 2026 |
| Repository | yoanbernabeu/supabase-pentest-skills ↗ |
How do you run a Supabase security audit?
Get a quick reference for all 24 Supabase security audit skills, identify the right skill for a specific audit task, and access usage examples for Supabase penetration testing.
Who is it for?
Developers starting Supabase penetration testing who need a command index and skill picker across the 24-audit skill collection.
Skip if: Developers not using Supabase or who already know the exact audit skill and command without needing the suite overview.
When should I use this skill?
A user asks which Supabase pentest skill to use, wants an overview of audit commands, or needs examples for /supabase-pentest or /supabase-detect.
What you get
Selected audit skill references, command cheat sheets, and guided /supabase-pentest or /supabase-report outputs from the 24-skill suite.
- Audit skill index
- Command usage examples
- Pentest workflow guidance
By the numbers
- References 24 Supabase security audit skills in the pentest collection
Files
Supabase Pentest Skills Help
Quick reference for all 24 security audit skills.
When to Use This Skill
- Need a quick overview of available skills
- Looking for the right skill for a specific task
- Want usage examples for a particular skill
Quick Start
# Full guided audit
/supabase-pentest https://myapp.example.com
# Check if app uses Supabase
/supabase-detect https://myapp.example.com
# Generate report from previous audit
/supabase-reportAll Skills Reference
Orchestration
| Skill | Command | Purpose |
|---|---|---|
supabase-pentest | /supabase-pentest <url> | Full guided security audit |
supabase-evidence | /supabase-evidence | Initialize evidence collection |
supabase-help | /supabase-help | This help reference |
Detection
| Skill | Command | Purpose |
|---|---|---|
supabase-detect | /supabase-detect <url> | Detect Supabase usage |
Extraction
| Skill | Command | Purpose |
|---|---|---|
supabase-extract-url | /supabase-extract-url <url> | Find Supabase project URL |
supabase-extract-anon-key | /supabase-extract-anon-key | Extract anon API key |
supabase-extract-service-key | /supabase-extract-service-key | Find leaked service key |
supabase-extract-jwt | /supabase-extract-jwt | Extract JWTs from code |
supabase-extract-db-string | /supabase-extract-db-string | Find DB connection strings |
API Audit
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-tables-list | /supabase-audit-tables-list | List exposed tables |
supabase-audit-tables-read | /supabase-audit-tables-read | Read table data |
supabase-audit-rls | /supabase-audit-rls | Test RLS policies |
supabase-audit-rpc | /supabase-audit-rpc | Test RPC functions |
Storage Audit
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-buckets-list | /supabase-audit-buckets-list | List storage buckets |
supabase-audit-buckets-read | /supabase-audit-buckets-read | Read bucket files |
supabase-audit-buckets-public | /supabase-audit-buckets-public | Find public buckets |
Auth Audit
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-auth-config | /supabase-audit-auth-config | Check auth settings |
supabase-audit-auth-signup | /supabase-audit-auth-signup | Test signup access |
supabase-audit-auth-users | /supabase-audit-auth-users | Test user enumeration |
supabase-audit-authenticated | /supabase-audit-authenticated | Create test user to detect IDOR |
Realtime & Functions
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-realtime | /supabase-audit-realtime | Test Realtime channels |
supabase-audit-functions | /supabase-audit-functions | Test Edge Functions |
Reporting
| Skill | Command | Purpose |
|---|---|---|
supabase-report | /supabase-report | Generate Markdown report |
supabase-report-compare | /supabase-report-compare <old> <new> | Compare two reports |
Severity Levels
| Level | Color | Description |
|---|---|---|
| P0 | 🔴 | Critical: data exposure, user data, privilege escalation |
| P1 | 🟠 | High: sensitive data, security misconfiguration |
| P2 | 🟡 | Medium: minor exposure, best practice violations |
Common Workflows
Quick Security Check
1. /supabase-detect https://myapp.com
2. /supabase-extract-anon-key
3. /supabase-audit-rls
4. /supabase-reportFull Audit
1. /supabase-pentest https://myapp.com
(Follow guided prompts through all phases)Storage-Only Audit
1. /supabase-detect https://myapp.com
2. /supabase-audit-buckets-list
3. /supabase-audit-buckets-public
4. /supabase-reportCompare After Fixes
1. Copy previous report to reports/audit-v1.md
2. Run new audit: /supabase-pentest https://myapp.com
3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.mdFiles and Directories Created
| File/Directory | Description |
|---|---|
.sb-pentest-context.json | Shared context between skills |
.sb-pentest-audit.log | Action log with timestamps |
.sb-pentest-evidence/ | Evidence directory for professional audits |
supabase-audit-report.md | Final security report |
Evidence Directory Structure
.sb-pentest-evidence/
├── README.md # Evidence index
├── curl-commands.sh # Reproducible commands
├── timeline.md # Chronological findings
├── 01-detection/ # Detection evidence
├── 02-extraction/ # Key extraction evidence
├── 03-api-audit/ # API audit evidence
├── 04-storage-audit/ # Storage audit evidence
├── 05-auth-audit/ # Auth audit evidence
├── 06-realtime-audit/ # Realtime audit evidence
├── 07-functions-audit/ # Functions audit evidence
└── screenshots/ # Optional screenshotsTips
1. Always run detection first — Most skills auto-invoke it, but it's faster to run explicitly 2. Check the context file — If a skill behaves unexpectedly, the context may have stale data 3. Use the orchestrator for full audits — It handles dependencies automatically 4. Save reports with dates — Rename supabase-audit-report.md to include the date for history
Need More Help?
- Each skill has detailed documentation — run
/supabase-<skill-name>for specifics - Check the README at the repository root
- Open an issue on GitHub for bugs or feature requests
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85How it compares
Pick supabase-help to choose among the 24 audit skills; invoke a specific audit skill when the exact vulnerability class is already known.
FAQ
How many skills does supabase-help reference?
supabase-help references all 24 Supabase security audit skills in yoanbernabeu/supabase-pentest-skills. The skill provides command overviews, usage examples, and guidance for picking the right audit task.
What commands does supabase-help document?
supabase-help documents /supabase-pentest for a full guided audit, /supabase-detect to check if a URL uses Supabase, and /supabase-report to generate output from a completed audit run.