Supabase Pentest
This orchestrates a full security audit of Supabase apps through six phases: detection, credential extraction, API testing, storage checks, auth analysis, and reporting. It enforces progressive logging to context files as you go, not just at the end, so if something crashes mid-audit you don't lose findings. Each phase extracts keys, tests RLS policies, enumerates tables and buckets, then documents everything with curl commands and timestamped evidence. The workflow is rigid by design with mandatory checkpoints between phases. Use this when you need a structured pentest of your own Supabase project and want the discipline of documented, reproducible steps rather than ad-hoc poking around.
- skills.sh installs
- 725
- GitHub stars
- 75
- last updated
- Aug 21, 2026
Install
$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-pentest --agent claude-codeInstalls into .claude/skills of the current project.
Files
Supabase Security Audit Orchestrator
🔵 RECOMMENDED: USE PLAN MODE FOR COMPLEX AUDITS
When your environment supports Plan Mode, it is strongly recommended to activate it before starting the audit:
- Use the
EnterPlanModetool at the start of the orchestration- Plan Mode enables better organization of multi-phase audits
- It allows the user to validate the approach before execution
- If Plan Mode is not available, proceed directly with execution
Plan Mode provides better traceability and user control over the audit process.
🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED
You MUST write to context files AS YOU GO, not just at the end.
- Write to
.sb-pentest-context.jsonIMMEDIATELY after each discovery- Log to
.sb-pentest-audit.logBEFORE and AFTER each action- DO NOT wait until a phase or skill completes to update files
- If the audit crashes or is interrupted, all prior findings must already be saved
This is not optional. Failure to write progressively is a critical error.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/yoanbernabeu/supabase-pentest-skills
- Categories
- Backend & APIs, Security, Automation & Workflows, Rust, Databases
- First seen
- Jun 3, 2026
More from yoanbernabeu/supabase-pentest-skills
All 23- Supabase Audit Auth Config576
- Supabase Audit Rpc551
- Supabase Audit Realtime544
- Supabase Help525
- Supabase Report516
- Supabase Audit Tables Read511
- Supabase Audit Buckets Public509
- Supabase Audit Auth Users506
- Supabase Audit Tables List504
- Supabase Extract Anon Key501
- Supabase Detect500
- Supabase Extract Service Key500
- Supabase Extract Db String499
- Supabase Audit Buckets List498
- Supabase Audit Buckets Read497
- Supabase Audit Auth Signup495
- Supabase Report Compare491
- Supabase Extract Jwt487
- Supabase Extract Url487
- Supabase Audit Authenticated446
- Supabase Audit Rls1.2K
- Supabase Audit Functions1.1K
Recommended
More Backend & APIs
auth0-authenticationmindrally/skillsGuidelines for implementing Auth0 authentication with best practices for security, rules, actions, and SDK integration724skills.sh installs
graphql-developmentmindrally/skillsGraphQL development guidelines with type-safe clients, schema design, and integration with React and Next.js.685skills.sh installs
websocket-implementationaj-geddes/useful-ai-promptsImplement real-time bidirectional communication with WebSockets including connection management, message routing, and scaling. Use when building real-time featu668skills.sh installs