Supabase Audit Rpc

This audits PostgreSQL functions exposed through Supabase's RPC endpoint, looking for three main problems: SECURITY DEFINER functions that bypass row-level security, missing auth.uid() checks that let anyone call admin functions, and SQL injection vulnerabilities from text parameters. It tests each function progressively and writes findings to context files as it goes, not at the end. The output shows you exactly which functions are dangerous and gives you the SQL to fix them. Use this after you've done a tables audit to find privilege escalation paths hidden in your database functions. The skill is paranoid about SECURITY DEFINER and anything that accepts raw text input, which is the right instinct.

skills.sh installs: 551
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-rpc --agent claude-code

Installs into .claude/skills of the current project.

Files

RPC Functions Audit

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each function tested

Log to .sb-pentest-audit.log BEFORE and AFTER each function test

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.

This skill discovers and tests PostgreSQL functions exposed via Supabase's RPC endpoint.

When to Use This Skill

To discover exposed database functions
To test if functions bypass RLS
To check for SQL injection in function parameters
As part of comprehensive API security testing

Prerequisites

Supabase URL and anon key available
Tables audit completed (recommended)

Understanding Supabase RPC

Supabase exposes PostgreSQL functions via:

POST https://[project].supabase.co/rest/v1/rpc/[function_name]

SKILL.md on GitHub

Details

Repository: github.com/yoanbernabeu/supabase-pentest-skills
Categories: Backend & APIs, Testing & QA, Security, Databases
First seen: Jun 3, 2026