Loading...
Loading...
Quick reference for all Supabase security audit skills with usage examples and command overview.
npx skill4agent add yoanbernabeu/supabase-pentest-skills supabase-help# Full guided audit
/supabase-pentest https://myapp.example.com
# Check if app uses Supabase
/supabase-detect https://myapp.example.com
# Generate report from previous audit
/supabase-report| Skill | Command | Purpose |
|---|---|---|
| | Full guided security audit |
| | Initialize evidence collection |
| | This help reference |
| Skill | Command | Purpose |
|---|---|---|
| | Detect Supabase usage |
| Skill | Command | Purpose |
|---|---|---|
| | Find Supabase project URL |
| | Extract anon API key |
| | Find leaked service key |
| | Extract JWTs from code |
| | Find DB connection strings |
| Skill | Command | Purpose |
|---|---|---|
| | List exposed tables |
| | Read table data |
| | Test RLS policies |
| | Test RPC functions |
| Skill | Command | Purpose |
|---|---|---|
| | List storage buckets |
| | Read bucket files |
| | Find public buckets |
| Skill | Command | Purpose |
|---|---|---|
| | Check auth settings |
| | Test signup access |
| | Test user enumeration |
| | Create test user to detect IDOR |
| Skill | Command | Purpose |
|---|---|---|
| | Test Realtime channels |
| | Test Edge Functions |
| Skill | Command | Purpose |
|---|---|---|
| | Generate Markdown report |
| | Compare two reports |
| Level | Color | Description |
|---|---|---|
| P0 | 🔴 | Critical: data exposure, user data, privilege escalation |
| P1 | 🟠 | High: sensitive data, security misconfiguration |
| P2 | 🟡 | Medium: minor exposure, best practice violations |
1. /supabase-detect https://myapp.com
2. /supabase-extract-anon-key
3. /supabase-audit-rls
4. /supabase-report1. /supabase-pentest https://myapp.com
(Follow guided prompts through all phases)1. /supabase-detect https://myapp.com
2. /supabase-audit-buckets-list
3. /supabase-audit-buckets-public
4. /supabase-report1. Copy previous report to reports/audit-v1.md
2. Run new audit: /supabase-pentest https://myapp.com
3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md| File/Directory | Description |
|---|---|
| Shared context between skills |
| Action log with timestamps |
| Evidence directory for professional audits |
| Final security report |
.sb-pentest-evidence/
├── README.md # Evidence index
├── curl-commands.sh # Reproducible commands
├── timeline.md # Chronological findings
├── 01-detection/ # Detection evidence
├── 02-extraction/ # Key extraction evidence
├── 03-api-audit/ # API audit evidence
├── 04-storage-audit/ # Storage audit evidence
├── 05-auth-audit/ # Auth audit evidence
├── 06-realtime-audit/ # Realtime audit evidence
├── 07-functions-audit/ # Functions audit evidence
└── screenshots/ # Optional screenshotssupabase-audit-report.md/supabase-<skill-name>