Supabase Audit Tables Read

Tests whether you can actually read data from your Supabase tables using the anon key, then tells you exactly what's exposed. After listing tables, it runs SELECT queries to pull sample rows and flags anything sensitive like emails, API keys, or financial data. The output groups tables by severity (P0 for secrets and PII, P1 for partial exposure) and shows you exactly which columns are leaking. Worth running this before you realize someone's been scraping your users table for six months. It writes findings progressively to context files so you don't lose results if something crashes mid-test.

skills.sh installs: 511
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-tables-read --agent claude-code

Installs into .claude/skills of the current project.

Files

Table Data Access Test

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each table tested

Log to .sb-pentest-audit.log BEFORE and AFTER each test

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.

This skill attempts to read data from exposed tables to determine what information is actually accessible.

When to Use This Skill

After listing tables, to verify actual access
To test RLS policy effectiveness
To assess the severity of data exposure
To document exactly what data can be retrieved

Prerequisites

Tables listed (auto-invokes supabase-audit-tables-list if needed)
Anon key available

How It Works

The skill performs SELECT queries on each exposed table:

GET https://[project].supabase.co/rest/v1/[table]?select=*&limit=5
Authorization: Bearer [anon-key]

Important: This is READ-ONLY. No data is modified or deleted.

SKILL.md on GitHub

Details

Repository: github.com/yoanbernabeu/supabase-pentest-skills
Categories: Backend & APIs, Security, Databases
First seen: Jun 3, 2026