majiayu000 Supabase Pentest Skills Help
Quick reference for all 24 security audit skills.
When to Use This Skill
- Need a quick overview of available skills
- Looking for the right skill for a specific task
- Want usage examples for a particular skill
Quick Start
# Full guided audit
/supabase-pentest https://myapp.example.com
# Check if app uses Supabase
/supabase-detect https://myapp.example.com
# Generate report from previous audit
/supabase-report
All Skills Reference
Orchestration
| Skill | Command | Purpose |
|---|---|---|
supabase-pentest |
/supabase-pentest <url> |
Full guided security audit |
supabase-evidence |
/supabase-evidence |
Initialize evidence collection |
supabase-help |
/supabase-help |
This help reference |
Detection
| Skill | Command | Purpose |
|---|---|---|
supabase-detect |
/supabase-detect <url> |
Detect Supabase usage |
Extraction
| Skill | Command | Purpose |
|---|---|---|
supabase-extract-url |
/supabase-extract-url <url> |
Find Supabase project URL |
supabase-extract-anon-key |
/supabase-extract-anon-key |
Extract anon API key |
supabase-extract-service-key |
/supabase-extract-service-key |
Find leaked service key |
supabase-extract-jwt |
/supabase-extract-jwt |
Extract JWTs from code |
supabase-extract-db-string |
/supabase-extract-db-string |
Find DB connection strings |
API Audit
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-tables-list |
/supabase-audit-tables-list |
List exposed tables |
supabase-audit-tables-read |
/supabase-audit-tables-read |
Read table data |
supabase-audit-rls |
/supabase-audit-rls |
Test RLS policies |
supabase-audit-rpc |
/supabase-audit-rpc |
Test RPC functions |
Storage Audit
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-buckets-list |
/supabase-audit-buckets-list |
List storage buckets |
supabase-audit-buckets-read |
/supabase-audit-buckets-read |
Read bucket files |
supabase-audit-buckets-public |
/supabase-audit-buckets-public |
Find public buckets |
Auth Audit
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-auth-config |
/supabase-audit-auth-config |
Check auth settings |
supabase-audit-auth-signup |
/supabase-audit-auth-signup |
Test signup access |
supabase-audit-auth-users |
/supabase-audit-auth-users |
Test user enumeration |
supabase-audit-authenticated |
/supabase-audit-authenticated |
Create test user to detect IDOR |
Realtime & Functions
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-realtime |
/supabase-audit-realtime |
Test Realtime channels |
supabase-audit-functions |
/supabase-audit-functions |
Test Edge Functions |
Reporting
| Skill | Command | Purpose |
|---|---|---|
supabase-report |
/supabase-report |
Generate Markdown report |
supabase-report-compare |
/supabase-report-compare <old> <new> |
Compare two reports |
Severity Levels
| Level | Color | Description |
|---|---|---|
| P0 | 🔴 | Critical: data exposure, user data, privilege escalation |
| P1 | 🟠 | High: sensitive data, security misconfiguration |
| P2 | 🟡 | Medium: minor exposure, best practice violations |
Common Workflows
Quick Security Check
1. /supabase-detect https://myapp.com
2. /supabase-extract-anon-key
3. /supabase-audit-rls
4. /supabase-report
Full Audit
1. /supabase-pentest https://myapp.com
(Follow guided prompts through all phases)
Storage-Only Audit
1. /supabase-detect https://myapp.com
2. /supabase-audit-buckets-list
3. /supabase-audit-buckets-public
4. /supabase-report
Compare After Fixes
1. Copy previous report to reports/audit-v1.md
2. Run new audit: /supabase-pentest https://myapp.com
3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md
Files and Directories Created
| File/Directory | Description |
|---|---|
.sb-pentest-context.json |
Shared context between skills |
.sb-pentest-audit.log |
Action log with timestamps |
.sb-pentest-evidence/ |
Evidence directory for professional audits |
supabase-audit-report.md |
Final security report |
Evidence Directory Structure
.sb-pentest-evidence/
├── README.md # Evidence index
├── curl-commands.sh # Reproducible commands
├── timeline.md # Chronological findings
├── 01-detection/ # Detection evidence
├── 02-extraction/ # Key extraction evidence
├── 03-api-audit/ # API audit evidence
├── 04-storage-audit/ # Storage audit evidence
├── 05-auth-audit/ # Auth audit evidence
├── 06-realtime-audit/ # Realtime audit evidence
├── 07-functions-audit/ # Functions audit evidence
└── screenshots/ # Optional screenshots
Tips
- Always run detection first — Most skills auto-invoke it, but it's faster to run explicitly
- Check the context file — If a skill behaves unexpectedly, the context may have stale data
- Use the orchestrator for full audits — It handles dependencies automatically
- Save reports with dates — Rename
supabase-audit-report.mdto include the date for history
Need More Help?
- Each skill has detailed documentation — run
/supabase-<skill-name>for specifics - Check the README at the repository root
- Open an issue on GitHub for bugs or feature requests