Back to Details

supabase-help

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Supabase Pentest Skills Help

Supabase安全审计技能帮助文档

Quick reference for all 24 security audit skills.
所有24项安全审计技能的快速参考。

When to Use This Skill

何时使用本技能

  • Need a quick overview of available skills
  • Looking for the right skill for a specific task
  • Want usage examples for a particular skill
  • 需要快速了解可用技能的概况
  • 为特定任务寻找合适的技能
  • 想要查看特定技能的使用示例

Quick Start

快速开始

bash
undefined
bash
undefined

Full guided audit

全流程引导式审计

/supabase-pentest https://myapp.example.com
/supabase-pentest https://myapp.example.com

Check if app uses Supabase

检测应用是否使用Supabase

/supabase-detect https://myapp.example.com
/supabase-detect https://myapp.example.com

Generate report from previous audit

根据之前的审计生成报告

/supabase-report
undefined
/supabase-report
undefined

All Skills Reference

全技能参考

Orchestration

编排类技能

SkillCommandPurpose
supabase-pentest
/supabase-pentest <url>
Full guided security audit
supabase-evidence
/supabase-evidence
Initialize evidence collection
supabase-help
/supabase-help
This help reference
技能命令用途
supabase-pentest
/supabase-pentest <url>
全流程引导式安全审计
supabase-evidence
/supabase-evidence
初始化证据收集
supabase-help
/supabase-help
本帮助参考手册

Detection

检测类技能

SkillCommandPurpose
supabase-detect
/supabase-detect <url>
Detect Supabase usage
技能命令用途
supabase-detect
/supabase-detect <url>
检测Supabase使用情况

Extraction

提取类技能

SkillCommandPurpose
supabase-extract-url
/supabase-extract-url <url>
Find Supabase project URL
supabase-extract-anon-key
/supabase-extract-anon-key
Extract anon API key
supabase-extract-service-key
/supabase-extract-service-key
Find leaked service key
supabase-extract-jwt
/supabase-extract-jwt
Extract JWTs from code
supabase-extract-db-string
/supabase-extract-db-string
Find DB connection strings
技能命令用途
supabase-extract-url
/supabase-extract-url <url>
查找Supabase项目URL
supabase-extract-anon-key
/supabase-extract-anon-key
提取匿名API密钥
supabase-extract-service-key
/supabase-extract-service-key
查找泄露的服务密钥
supabase-extract-jwt
/supabase-extract-jwt
从代码中提取JWT
supabase-extract-db-string
/supabase-extract-db-string
查找数据库连接字符串

API Audit

API审计类技能

SkillCommandPurpose
supabase-audit-tables-list
/supabase-audit-tables-list
List exposed tables
supabase-audit-tables-read
/supabase-audit-tables-read
Read table data
supabase-audit-rls
/supabase-audit-rls
Test RLS policies
supabase-audit-rpc
/supabase-audit-rpc
Test RPC functions
技能命令用途
supabase-audit-tables-list
/supabase-audit-tables-list
列出暴露的表
supabase-audit-tables-read
/supabase-audit-tables-read
读取表数据
supabase-audit-rls
/supabase-audit-rls
测试RLS策略
supabase-audit-rpc
/supabase-audit-rpc
测试RPC函数

Storage Audit

存储审计类技能

SkillCommandPurpose
supabase-audit-buckets-list
/supabase-audit-buckets-list
List storage buckets
supabase-audit-buckets-read
/supabase-audit-buckets-read
Read bucket files
supabase-audit-buckets-public
/supabase-audit-buckets-public
Find public buckets
技能命令用途
supabase-audit-buckets-list
/supabase-audit-buckets-list
列出存储桶
supabase-audit-buckets-read
/supabase-audit-buckets-read
读取存储桶文件
supabase-audit-buckets-public
/supabase-audit-buckets-public
查找公共存储桶

Auth Audit

认证审计类技能

SkillCommandPurpose
supabase-audit-auth-config
/supabase-audit-auth-config
Check auth settings
supabase-audit-auth-signup
/supabase-audit-auth-signup
Test signup access
supabase-audit-auth-users
/supabase-audit-auth-users
Test user enumeration
supabase-audit-authenticated
/supabase-audit-authenticated
Create test user to detect IDOR
技能命令用途
supabase-audit-auth-config
/supabase-audit-auth-config
检查认证设置
supabase-audit-auth-signup
/supabase-audit-auth-signup
测试注册访问权限
supabase-audit-auth-users
/supabase-audit-auth-users
测试用户枚举
supabase-audit-authenticated
/supabase-audit-authenticated
创建测试用户以检测IDOR

Realtime & Functions

实时服务与函数审计类技能

SkillCommandPurpose
supabase-audit-realtime
/supabase-audit-realtime
Test Realtime channels
supabase-audit-functions
/supabase-audit-functions
Test Edge Functions
技能命令用途
supabase-audit-realtime
/supabase-audit-realtime
测试Realtime通道
supabase-audit-functions
/supabase-audit-functions
测试Edge Functions

Reporting

报告类技能

SkillCommandPurpose
supabase-report
/supabase-report
Generate Markdown report
supabase-report-compare
/supabase-report-compare <old> <new>
Compare two reports
技能命令用途
supabase-report
/supabase-report
生成Markdown报告
supabase-report-compare
/supabase-report-compare <old> <new>
对比两份报告

Severity Levels

严重程度等级

LevelColorDescription
P0🔴Critical: data exposure, user data, privilege escalation
P1🟠High: sensitive data, security misconfiguration
P2🟡Medium: minor exposure, best practice violations
等级颜色描述
P0🔴关键：数据泄露、用户数据风险、权限提升
P1🟠高：敏感数据风险、安全配置错误
P2🟡中：轻微数据泄露、违反最佳实践

Common Workflows

常见工作流程

Quick Security Check

快速安全检查

1. /supabase-detect https://myapp.com
2. /supabase-extract-anon-key
3. /supabase-audit-rls
4. /supabase-report
1. /supabase-detect https://myapp.com
2. /supabase-extract-anon-key
3. /supabase-audit-rls
4. /supabase-report

Full Audit

完整审计流程

1. /supabase-pentest https://myapp.com
   (Follow guided prompts through all phases)
1. /supabase-pentest https://myapp.com
   (按照引导提示完成所有阶段)

Storage-Only Audit

仅存储审计流程

1. /supabase-detect https://myapp.com
2. /supabase-audit-buckets-list
3. /supabase-audit-buckets-public
4. /supabase-report
1. /supabase-detect https://myapp.com
2. /supabase-audit-buckets-list
3. /supabase-audit-buckets-public
4. /supabase-report

Compare After Fixes

修复后对比流程

1. Copy previous report to reports/audit-v1.md
2. Run new audit: /supabase-pentest https://myapp.com
3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md
1. 将之前的报告复制到reports/audit-v1.md
2. 运行新审计：/supabase-pentest https://myapp.com
3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md

Files and Directories Created

创建的文件和目录

File/DirectoryDescription
.sb-pentest-context.json
Shared context between skills
.sb-pentest-audit.log
Action log with timestamps
.sb-pentest-evidence/
Evidence directory for professional audits
supabase-audit-report.md
Final security report
文件/目录描述
.sb-pentest-context.json
技能间共享的上下文数据
.sb-pentest-audit.log
带时间戳的操作日志
.sb-pentest-evidence/
专业审计用的证据目录
supabase-audit-report.md
最终安全报告

Evidence Directory Structure

证据目录结构

.sb-pentest-evidence/
├── README.md                 # Evidence index
├── curl-commands.sh          # Reproducible commands
├── timeline.md               # Chronological findings
├── 01-detection/             # Detection evidence
├── 02-extraction/            # Key extraction evidence
├── 03-api-audit/             # API audit evidence
├── 04-storage-audit/         # Storage audit evidence
├── 05-auth-audit/            # Auth audit evidence
├── 06-realtime-audit/        # Realtime audit evidence
├── 07-functions-audit/       # Functions audit evidence
└── screenshots/              # Optional screenshots
.sb-pentest-evidence/
├── README.md                 # 证据索引
├── curl-commands.sh          # 可复现的命令
├── timeline.md               # 按时间顺序排列的发现
├── 01-detection/             # 检测类证据
├── 02-extraction/            # 密钥提取类证据
├── 03-api-audit/             # API审计类证据
├── 04-storage-audit/         # 存储审计类证据
├── 05-auth-audit/            # 认证审计类证据
├── 06-realtime-audit/        # 实时服务审计类证据
├── 07-functions-audit/       # 函数审计类证据
└── screenshots/              # 可选截图目录

Tips

提示

  1. Always run detection first — Most skills auto-invoke it, but it's faster to run explicitly
  2. Check the context file — If a skill behaves unexpectedly, the context may have stale data
  3. Use the orchestrator for full audits — It handles dependencies automatically
  4. Save reports with dates — Rename 
    supabase-audit-report.md
    to include the date for history
  1. 始终先运行检测命令 — 大多数技能会自动调用检测，但显式运行会更快
  2. 检查上下文文件 — 如果某个技能表现异常，可能是上下文文件中有过期数据
  3. 使用编排工具进行完整审计 — 它会自动处理依赖关系
  4. 给报告添加日期保存 — 将
    supabase-audit-report.md
    重命名并包含日期，以便留存历史记录

Need More Help?

需要更多帮助？

  • Each skill has detailed documentation — run 
    /supabase-<skill-name>
    for specifics
  • Check the README at the repository root
  • Open an issue on GitHub for bugs or feature requests
  • 每个技能都有详细文档 — 运行
    /supabase-<skill-name>
    查看详情
  • 查看仓库根目录的README文件
  • 在GitHub上提交issue反馈bug或请求功能