Supabase Audit Tables List

This one hits the Supabase PostgREST OpenAPI endpoint to enumerate every table exposed through your API, which is your actual attack surface. It classifies them by risk (financial data, PII, public content) and shows columns, primary keys, and foreign key relationships. Use it at the start of any security audit before you test RLS policies or try reading data. The output is pretty thorough, showing you not just what's in the schema but also probing for hidden tables that exist but aren't advertised. One thing to note is the aggressive emphasis on progressive file writing, which makes sense if you're auditing dozens of tables and don't want to lose findings mid-run.

skills.sh installs: 504
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-tables-list --agent claude-code

Installs into .claude/skills of the current project.

Files

List Exposed Tables

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each discovery

Log to .sb-pentest-audit.log BEFORE and AFTER each action

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.

This skill discovers all database tables exposed through the Supabase PostgREST API.

When to Use This Skill

To understand the API attack surface
Before testing RLS policies
To inventory exposed data models
As part of a comprehensive security audit

Prerequisites

Supabase URL extracted (auto-invokes if needed)
Anon key extracted (auto-invokes if needed)

How It Works

Supabase exposes tables via PostgREST at:

https://[project-ref].supabase.co/rest/v1/

The skill uses the OpenAPI schema endpoint to enumerate tables:

https://[project-ref].supabase.co/rest/v1/?apikey=[anon-key]

What Gets Exposed

SKILL.md on GitHub

Details

Repository: github.com/yoanbernabeu/supabase-pentest-skills
Categories: Backend & APIs, Security, Databases
First seen: Jun 3, 2026