Supabase Extract Jwt

Pulls JWTs out of client-side code, cookies, and localStorage references when you're pentesting a Supabase app. It decodes the tokens, flags the really bad stuff like hardcoded service role keys or user access tokens with PII baked in, and distinguishes between expected exposure (anon keys are fine) and actual problems (developer tokens left in production bundles). The progressive logging is aggressive by design, writing findings to context files after each discovery so you don't lose data if Claude times out mid-scan. Most useful right after initial Supabase detection when you want to see what secrets made it into the build. Saves everything to a pentest evidence directory with severity ratings from P0 to P2.

skills.sh installs: 487
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-extract-jwt --agent claude-code

Installs into .claude/skills of the current project.

Files

Supabase JWT Extraction

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each discovery

Log to .sb-pentest-audit.log BEFORE and AFTER each action

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.