Supabase Audit Buckets Read
Tests whether you can actually read files from your Supabase storage buckets using the anon key, not just whether the buckets exist. Crawls through each bucket attempting to list files, grab metadata, and download samples, then flags anything that looks sensitive (database backups, .env files, invoices, IDs) sitting in public buckets. The output gets pretty alarming if you've got secrets or PII exposed. Worth running this after the initial bucket enumeration to see what an unauthenticated user could pull down. It writes findings progressively to avoid losing results mid-scan, which matters when you're testing dozens of buckets.
- skills.sh installs
- 497
- GitHub stars
- 75
- last updated
- Aug 21, 2026
Install
$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-buckets-read --agent claude-codeInstalls into .claude/skills of the current project.
Files
Bucket File Access Test
🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED
You MUST write to context files AS YOU GO, not just at the end.
- Write to
.sb-pentest-context.jsonIMMEDIATELY after each bucket tested- Log to
.sb-pentest-audit.logBEFORE and AFTER each file access test- DO NOT wait until the skill completes to update files
- If the skill crashes or is interrupted, all prior findings must already be saved
This is not optional. Failure to write progressively is a critical error.
This skill tests actual file access in storage buckets to verify permissions.
When to Use This Skill
- After listing buckets, to verify actual access
- To test storage RLS policy effectiveness
- To check for sensitive file exposure
- To document what files are accessible
Prerequisites
- Buckets listed (auto-invokes if needed)
- Anon key available
How It Works
The skill attempts to:
- List files in each bucket
- Read file metadata
- Download sample files (for content type verification)
- Check public URL access
Important: This is READ-ONLY. No files are modified or deleted.
Test Approach
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/yoanbernabeu/supabase-pentest-skills
- Categories
- Backend & APIs, Security, Databases
- First seen
- Jun 3, 2026
More from yoanbernabeu/supabase-pentest-skills
All 23- Supabase Audit Auth Signup495
- Supabase Report Compare491
- Supabase Extract Jwt487
- Supabase Extract Url487
- Supabase Audit Authenticated446
- Supabase Audit Rls1.2K
- Supabase Audit Functions1.1K
- Supabase Pentest725
- Supabase Audit Auth Config576
- Supabase Audit Rpc551
- Supabase Audit Realtime544
- Supabase Help525
- Supabase Report516
- Supabase Audit Tables Read511
- Supabase Audit Buckets Public509
- Supabase Audit Auth Users506
- Supabase Audit Tables List504
- Supabase Extract Anon Key501
- Supabase Detect500
- Supabase Extract Service Key500
- Supabase Extract Db String499
- Supabase Audit Buckets List498
Recommended
More Backend & APIs
api-contract-testingsecondsky/claude-skillsVerifies API contracts between services using consumer-driven contracts, schema validation, and tools like Pact. Use when testing microservices communication, p491skills.sh installs
agentica-claude-proxyparcadei/continuous-claude-v3Guide for integrating Agentica SDK with Claude Code CLI proxy485skills.sh installs
jimeng-api-video-genwvlvik/toy-skills(project - Skill) Generate AI videos using Volcengine Jimeng Video 3.0 Pro API. Use when users request video generation from text prompts or images, including t481skills.sh installs
api-changelog-versioningaj-geddes/useful-ai-promptsDocument API changes, breaking changes, migration guides, and version history for APIs. Use when documenting API versioning, breaking changes, or creating API m477skills.sh installsdatabase-monitoringaj-geddes/useful-ai-promptsMonitor database performance and health. Use when setting up monitoring, analyzing metrics, or troubleshooting database issues.467skills.sh installs
auth0-fastapi-apiauth0/agent-skillsUse when protecting FastAPI endpoints with JWT Bearer token validation, scope checks, or DPoP binding. Integrates auth0-fastapi-api for stateless APIs receiving461skills.sh installs