Supabase Extract Url

This extracts Supabase project URLs from client-side JavaScript, scanning for patterns like createClient() calls, environment variable references, and config objects in bundled code. It validates what it finds by checking URL format and attempting to reach the REST API endpoint, then generates all the derivative endpoints (auth, storage, realtime). Handles multiple URLs gracefully by ranking them by frequency. The progressive logging approach is solid, you write findings to context files immediately after each discovery rather than batching at the end, which matters if you're scanning a large app and something times out. Run this after detecting Supabase usage, then follow up with the anon key and service key extraction skills.

skills.sh installs: 487
GitHub stars: 75
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-extract-url --agent claude-code

Installs into .claude/skills of the current project.

Files

Supabase URL Extraction

🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED

You MUST write to context files AS YOU GO, not just at the end.

Write to .sb-pentest-context.json IMMEDIATELY after each discovery

Log to .sb-pentest-audit.log BEFORE and AFTER each action

DO NOT wait until the skill completes to update files

If the skill crashes or is interrupted, all prior findings must already be saved

This is not optional. Failure to write progressively is a critical error.

This skill extracts the Supabase project URL from a web application's client-side code.

When to Use This Skill

After detecting Supabase usage, to get the exact project URL
When you need the API base URL for further testing
To identify which Supabase project an application uses

Prerequisites

Target URL accessible
Supabase usage detected (or suspected)

How It Works

The skill scans for URL patterns in:

1. JavaScript Source Code

// Direct URL references
const SUPABASE_URL = 'https://abc123.supabase.co'
createClient('https://abc123.supabase.co', key)

SKILL.md on GitHub

Details

Repository: github.com/yoanbernabeu/supabase-pentest-skills
Categories: Backend & APIs, Security, Databases
First seen: Jun 3, 2026