Supabase Audit Functions

Audits your Supabase Edge Functions for security holes by discovering exposed endpoints and testing them for auth bypasses, IDOR vulnerabilities, and privilege escalation issues. It'll systematically probe each function it finds (through client code analysis and common name enumeration) and check whether authentication is actually enforced, if users can access other users' data, and if admin functions are properly locked down. The output is detailed with actual curl commands showing exploits. Writes findings progressively to context files as it goes, which matters if you're testing a bunch of functions and don't want to lose results mid-audit. Most useful when you've got custom Edge Functions handling payments, user data, or admin operations and want to verify they're not accidentally wide open.

skills.sh installs: 1.1K
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-functions --agent claude-code

Installs into .claude/skills of the current project.

Files

Edge Functions Audit

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each function tested

Log to .sb-pentest-audit.log BEFORE and AFTER each function test

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.

This skill discovers and tests Supabase Edge Functions for security issues.

When to Use This Skill

To discover exposed Edge Functions
To test function authentication requirements
To check for input validation issues
As part of comprehensive security audit

Prerequisites

Supabase URL available
Detection completed

Understanding Edge Functions

Supabase Edge Functions are Deno-based serverless functions:

https://[project].supabase.co/functions/v1/[function-name]

SKILL.md on GitHub

Details

Repository: github.com/yoanbernabeu/supabase-pentest-skills
Categories: Backend & APIs, Testing & QA, Security, Databases
First seen: Jun 3, 2026