Supabase Pentest Skills Help

Quick reference for all 24 security audit skills.

When to Use This Skill

• Need a quick overview of available skills
• Looking for the right skill for a specific task
• Want usage examples for a particular skill

Quick Start

# Full guided audit
/supabase-pentest https://myapp.example.com

# Check if app uses Supabase
/supabase-detect https://myapp.example.com

# Generate report from previous audit
/supabase-report

All Skills Reference

Orchestration

Skill	Command	Purpose
supabase-pentest	/supabase-pentest <url>	Full guided security audit
supabase-evidence	/supabase-evidence	Initialize evidence collection
supabase-help	/supabase-help	This help reference

Detection

Skill	Command	Purpose
supabase-detect	/supabase-detect <url>	Detect Supabase usage

Extraction

Skill	Command	Purpose
supabase-extract-url	/supabase-extract-url <url>	Find Supabase project URL
supabase-extract-anon-key	/supabase-extract-anon-key	Extract anon API key
supabase-extract-service-key	/supabase-extract-service-key	Find leaked service key
supabase-extract-jwt	/supabase-extract-jwt	Extract JWTs from code
supabase-extract-db-string	/supabase-extract-db-string	Find DB connection strings

API Audit

Skill	Command	Purpose
supabase-audit-tables-list	/supabase-audit-tables-list	List exposed tables
supabase-audit-tables-read	/supabase-audit-tables-read	Read table data
supabase-audit-rls	/supabase-audit-rls	Test RLS policies
supabase-audit-rpc	/supabase-audit-rpc	Test RPC functions

Storage Audit

Skill	Command	Purpose
supabase-audit-buckets-list	/supabase-audit-buckets-list	List storage buckets
supabase-audit-buckets-read	/supabase-audit-buckets-read	Read bucket files
supabase-audit-buckets-public	/supabase-audit-buckets-public	Find public buckets

Auth Audit

Skill	Command	Purpose
supabase-audit-auth-config	/supabase-audit-auth-config	Check auth settings
supabase-audit-auth-signup	/supabase-audit-auth-signup	Test signup access
supabase-audit-auth-users	/supabase-audit-auth-users	Test user enumeration
supabase-audit-authenticated	/supabase-audit-authenticated	Create test user to detect IDOR

Realtime & Functions

Skill	Command	Purpose
supabase-audit-realtime	/supabase-audit-realtime	Test Realtime channels
supabase-audit-functions	/supabase-audit-functions	Test Edge Functions

Reporting

Skill	Command	Purpose
supabase-report	/supabase-report	Generate Markdown report
supabase-report-compare	/supabase-report-compare <old> <new>	Compare two reports

Severity Levels

Level	Color	Description
P0	🔴	Critical: data exposure, user data, privilege escalation
P1	🟠	High: sensitive data, security misconfiguration
P2	🟡	Medium: minor exposure, best practice violations

Common Workflows

Quick Security Check

1. /supabase-detect https://myapp.com
2. /supabase-extract-anon-key
3. /supabase-audit-rls
4. /supabase-report

Full Audit

1. /supabase-pentest https://myapp.com
   (Follow guided prompts through all phases)

Storage-Only Audit

1. /supabase-detect https://myapp.com
2. /supabase-audit-buckets-list
3. /supabase-audit-buckets-public
4. /supabase-report

Compare After Fixes

1. Copy previous report to reports/audit-v1.md
2. Run new audit: /supabase-pentest https://myapp.com
3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md

Files and Directories Created

File/Directory	Description
.sb-pentest-context.json	Shared context between skills
.sb-pentest-audit.log	Action log with timestamps
.sb-pentest-evidence/	Evidence directory for professional audits
supabase-audit-report.md	Final security report

Evidence Directory Structure

.sb-pentest-evidence/
├── README.md                 # Evidence index
├── curl-commands.sh          # Reproducible commands
├── timeline.md               # Chronological findings
├── 01-detection/             # Detection evidence
├── 02-extraction/            # Key extraction evidence
├── 03-api-audit/             # API audit evidence
├── 04-storage-audit/         # Storage audit evidence
├── 05-auth-audit/            # Auth audit evidence
├── 06-realtime-audit/        # Realtime audit evidence
├── 07-functions-audit/       # Functions audit evidence
└── screenshots/              # Optional screenshots

Tips

1. Always run detection first — Most skills auto-invoke it, but it's faster to run explicitly
2. Check the context file — If a skill behaves unexpectedly, the context may have stale data
3. Use the orchestrator for full audits — It handles dependencies automatically
4. Save reports with dates — Rename supabase-audit-report.md to include the date for history

Need More Help?

• Each skill has detailed documentation — run /supabase-<skill-name> for specifics
• Check the README at the repository root
• Open an issue on GitHub for bugs or feature requests