SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillssupabase-help

supabase-help

General & other

View repository

Updated 10-15 19:48

About this skill

Supabase Pentest Skills Help

Quick reference for all 24 security audit skills.

When to Use This Skill

  • Need a quick overview of available skills
  • Looking for the right skill for a specific task
  • Want usage examples for a particular skill

Quick Start

# Full guided audit
/supabase-pentest https://myapp.example.com

# Check if app uses Supabase
/supabase-detect https://myapp.example.com
Generate report from previous audit

/supabase-report


## All Skills Reference

### Orchestration

| Skill | Command | Purpose |
|-------|---------|---------|
| `supabase-pentest` | `/supabase-pentest <url>` | Full guided security audit |
| `supabase-evidence` | `/supabase-evidence` | Initialize evidence collection |
| `supabase-help` | `/supabase-help` | This help reference |

### Detection

| Skill | Command | Purpose |
|-------|---------|---------|
| `supabase-detect` | `/supabase-detect <url>` | Detect Supabase usage |

### Extraction

| Skill | Command | Purpose |
|-------|---------|---------|
| `supabase-extract-url` | `/supabase-extract-url <url>` | Find Supabase project URL |
| `supabase-extract-anon-key` | `/supabase-extract-anon-key` | Extract anon API key |
| `supabase-extract-service-key` | `/supabase-extract-service-key` | Find leaked service key |
| `supabase-extract-jwt` | `/supabase-extract-jwt` | Extract JWTs from code |
| `supabase-extract-db-string` | `/supabase-extract-db-string` | Find DB connection strings |

### API Audit

| Skill | Command | Purpose |
|-------|---------|---------|
| `supabase-audit-tables-list` | `/supabase-audit-tables-list` | List exposed tables |
| `supabase-audit-tables-read` | `/supabase-audit-tables-read` | Read table data |
| `supabase-audit-rls` | `/supabase-audit-rls` | Test RLS policies |
| `supabase-audit-rpc` | `/supabase-audit-rpc` | Test RPC functions |

### Storage Audit

| Skill | Command | Purpose |
|-------|---------|---------|
| `supabase-audit-buckets-list` | `/supabase-audit-buckets-list` | List storage buckets |
| `supabase-audit-buckets-read` | `/supabase-audit-buckets-read` | Read bucket files |
| `supabase-audit-buckets-public` | `/supabase-audit-buckets-public` | Find public buckets |

### Auth Audit

| Skill | Command | Purpose |
|-------|---------|---------|
| `supabase-audit-auth-config` | `/supabase-audit-auth-config` | Check auth settings |
| `supabase-audit-auth-signup` | `/supabase-audit-auth-signup` | Test signup access |
| `supabase-audit-auth-users` | `/supabase-audit-auth-users` | Test user enumeration |
| `supabase-audit-authenticated` | `/supabase-audit-authenticated` | **Create test user to detect IDOR** |

### Realtime & Functions

| Skill | Command | Purpose |
|-------|---------|---------|
| `supabase-audit-realtime` | `/supabase-audit-realtime` | Test Realtime channels |
| `supabase-audit-functions` | `/supabase-audit-functions` | Test Edge Functions |

### Reporting

| Skill | Command | Purpose |
|-------|---------|---------|
| `supabase-report` | `/supabase-report` | Generate Markdown report |
| `supabase-report-compare` | `/supabase-report-compare <old> <new>` | Compare two reports |

## Severity Levels

| Level | Color | Description |
|-------|-------|-------------|
| **P0** | 🔴 | Critical: data exposure, user data, privilege escalation |
| **P1** | 🟠 | High: sensitive data, security misconfiguration |
| **P2** | 🟡 | Medium: minor exposure, best practice violations |

## Common Workflows

### Quick Security Check
  1. /supabase-detect https://myapp.com
  2. /supabase-extract-anon-key
  3. /supabase-audit-rls
  4. /supabase-report

### Full Audit
  1. /supabase-pentest https://myapp.com (Follow guided prompts through all phases)

### Storage-Only Audit
  1. /supabase-detect https://myapp.com
  2. /supabase-audit-buckets-list
  3. /supabase-audit-buckets-public
  4. /supabase-report

### Compare After Fixes
  1. Copy previous report to reports/audit-v1.md
  2. Run new audit: /supabase-pentest https://myapp.com
  3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md

## Files and Directories Created

| File/Directory | Description |
|----------------|-------------|
| `.sb-pentest-context.json` | Shared context between skills |
| `.sb-pentest-audit.log` | Action log with timestamps |
| `.sb-pentest-evidence/` | **Evidence directory for professional audits** |
| `supabase-audit-report.md` | Final security report |

### Evidence Directory Structure

.sb-pentest-evidence/ ├── README.md # Evidence index ├── curl-commands.sh # Reproducible commands ├── timeline.md # Chronological findings ├── 01-detection/ # Detection evidence ├── 02-extraction/ # Key extraction evidence ├── 03-api-audit/ # API audit evidence ├── 04-storage-audit/ # Storage audit evidence ├── 05-auth-audit/ # Auth audit evidence ├── 06-realtime-audit/ # Realtime audit evidence ├── 07-functions-audit/ # Functions audit evidence └── screenshots/ # Optional screenshots


## Tips

1. **Always run detection first** — Most skills auto-invoke it, but it's faster to run explicitly
2. **Check the context file** — If a skill behaves unexpectedly, the context may have stale data
3. **Use the orchestrator for full audits** — It handles dependencies automatically
4. **Save reports with dates** — Rename `supabase-audit-report.md` to include the date for history

## Need More Help?

- Each skill has detailed documentation — run `/supabase-<skill-name>` for specifics
- Check the README at the repository root
- Open an issue on GitHub for bugs or feature requests