Supabase Extract Anon Key
Extracts the Supabase anon key from client-side code, which is actually supposed to be there, unlike the service key. It searches JavaScript bundles for JWT patterns, decodes the payload to verify it's really the anon role, and checks if it matches your project URL. The skill writes findings progressively to context files as it goes rather than batching at the end, which matters if you're running a longer pentest chain. Finding this key is just step one. The real question is whether RLS is configured properly, because the anon key is safe only when row level security actually blocks unauthorized access.
- skills.sh installs
- 501
- GitHub stars
- 75
- last updated
- Aug 21, 2026
Install
$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-extract-anon-key --agent claude-codeInstalls into .claude/skills of the current project.
Files
Supabase Anon Key Extraction
🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED
You MUST write to context files AS YOU GO, not just at the end.
- Write to
.sb-pentest-context.jsonIMMEDIATELY after each discovery- Log to
.sb-pentest-audit.logBEFORE and AFTER each action- DO NOT wait until the skill completes to update files
- If the skill crashes or is interrupted, all prior findings must already be saved
This is not optional. Failure to write progressively is a critical error.
This skill extracts the Supabase anonymous (public) API key from client-side code.
When to Use This Skill
- After extracting the Supabase URL, to get the API key for testing
- To verify that only the anon key (not service key) is exposed
- Before running API audit skills that require authentication
Prerequisites
- Supabase URL extracted (or will auto-invoke
supabase-extract-url) - Target application accessible
Understanding Anon Keys
The anon key (also called public key) is:
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/yoanbernabeu/supabase-pentest-skills
- Categories
- Backend & APIs, Testing & QA, Security, Databases
- First seen
- Jun 3, 2026
More from yoanbernabeu/supabase-pentest-skills
All 23- Supabase Detect500
- Supabase Extract Service Key500
- Supabase Extract Db String499
- Supabase Audit Buckets List498
- Supabase Audit Buckets Read497
- Supabase Audit Auth Signup495
- Supabase Report Compare491
- Supabase Extract Jwt487
- Supabase Extract Url487
- Supabase Audit Authenticated446
- Supabase Audit Rls1.2K
- Supabase Audit Functions1.1K
- Supabase Pentest725
- Supabase Audit Auth Config576
- Supabase Audit Rpc551
- Supabase Audit Realtime544
- Supabase Help525
- Supabase Report516
- Supabase Audit Tables Read511
- Supabase Audit Buckets Public509
- Supabase Audit Auth Users506
- Supabase Audit Tables List504
Recommended
More Backend & APIs
supabase-detectyoanbernabeu/supabase-pentest-skillsDetect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.500skills.sh installs
api-response-optimizationaj-geddes/useful-ai-promptsOptimize API response times through caching, compression, and efficient payloads. Improve backend performance and reduce network traffic.490skills.sh installs
agentica-serverparcadei/continuous-claude-v3Agentica server + Claude proxy setup - architecture, startup sequence, debugging476skills.sh installs
api-security-best-practicesdavila7/claude-code-templatesImplement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities466skills.sh installs
api-response-optimizationsecondsky/claude-skillsOptimizes API performance through payload reduction, caching strategies, and compression techniques. Use when improving API response times, reducing bandwidth u434skills.sh installs
ln-775-api-docs-generatorlevnikolaevich/claude-code-skillsConfigures Swagger/OpenAPI documentation for backend APIs. Use when adding interactive API docs to a project.432skills.sh installs