Supabase Detect

This is a reconnaissance tool that checks whether a website runs on Supabase by scanning for telltale signs like supabase.co domains, the @supabase/supabase-js client library, REST API endpoints, and response headers. It's the first step before running any Supabase security audit since there's no point testing for Supabase vulnerabilities if the app doesn't use it. The skill writes findings to a JSON context file and audit log as it works, not just at the end, which means you won't lose progress if something crashes mid-scan. It handles edge cases like custom domains and self-hosted instances, though detection gets trickier there. Confidence levels range from high (multiple evidence types) to low (might be a false positive).

skills.sh installs: 500
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-detect --agent claude-code

Installs into .claude/skills of the current project.

Files

Supabase Detection

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each discovery

Log to .sb-pentest-audit.log BEFORE and AFTER each action

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.