Updated 8mo ago
by yoanbernabeu
supabase-pentest-skills
24 AI Agent Skills for professional security auditing of Supabase applications. Detection, key extraction, RLS testing, storage audit, IDOR detection, and comprehensive reporting. Works with Claude Code, Cursor, Windsurf, and 30+ AI agents.
69 GitHub stars (69)
Steady at 69 stars — no new stars in the 16 days since Sep 30.
- 24 skills (24 skills found in its SKILL.md files)
- 4 forks (4 forks)
- 8mo ago last update (Last updated 8mo ago)
Install
Skills CLI
npx skills add yoanbernabeu/supabase-pentest-skills
Asks which skills and agents to install. Just one: npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-rls — add -g for every project.
Claude Code
git clone https://github.com/yoanbernabeu/supabase-pentest-skillscp -r "supabase-pentest-skills/skills/audit-api/supabase-audit-rls" ~/.claude/skills/
Copies the supabase-audit-rls skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add yoanbernabeu/supabase-pentest-skills
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
supabase-audit-rls
Test Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.
skills/audit-api/supabase-audit-rls/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-rpc
List and test exposed PostgreSQL RPC functions for security issues and potential RLS bypass.
skills/audit-api/supabase-audit-rpc/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-tables-list
List all tables exposed via the Supabase PostgREST API to identify the attack surface.
skills/audit-api/supabase-audit-tables-list/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-tables-read
Attempt to read data from exposed tables to verify actual data exposure and RLS effectiveness.
skills/audit-api/supabase-audit-tables-read/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-auth-config
Analyze Supabase authentication configuration for security weaknesses and misconfigurations.
skills/audit-auth/supabase-audit-auth-config/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-auth-signup
Test if user signup is open and identify potential abuse vectors in the registration process.
skills/audit-auth/supabase-audit-auth-signup/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-auth-users
Test for user enumeration vulnerabilities through various authentication endpoints.
skills/audit-auth/supabase-audit-auth-users/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-authenticated
Create a test user (with explicit permission) to audit what authenticated users can access vs anonymous users. Detects IDOR, cross-user access, and privilege escalation.
skills/audit-auth/supabase-audit-authenticated/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-functions
Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.
skills/audit-functions/supabase-audit-functions/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-realtime
Test Supabase Realtime WebSocket channels for unauthorized subscriptions and data exposure.
skills/audit-realtime/supabase-audit-realtime/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-buckets-list
List all storage buckets and their configuration to identify the storage attack surface.
skills/audit-storage/supabase-audit-buckets-list/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-buckets-public
Identify storage buckets that are publicly accessible and may contain sensitive data.
skills/audit-storage/supabase-audit-buckets-public/SKILL.md on GitHub (opens in a new tab) -
supabase-audit-buckets-read
Attempt to list and read files from storage buckets to verify access controls.
skills/audit-storage/supabase-audit-buckets-read/SKILL.md on GitHub (opens in a new tab) -
supabase-detect
Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.
skills/detection/supabase-detect/SKILL.md on GitHub (opens in a new tab) -
supabase-evidence
Initialize and manage the evidence collection directory for professional security audits with documented proof of findings.
skills/evidence/supabase-evidence/SKILL.md on GitHub (opens in a new tab) -
supabase-extract-anon-key
Extract the Supabase anon/public API key from client-side code. This key is expected in client apps but important for RLS testing.
skills/extraction/supabase-extract-anon-key/SKILL.md on GitHub (opens in a new tab) -
supabase-extract-db-string
CRITICAL - Detect exposed PostgreSQL database connection strings in client-side code. Direct DB access is a P0 issue.
skills/extraction/supabase-extract-db-string/SKILL.md on GitHub (opens in a new tab) -
supabase-extract-jwt
Extract and decode Supabase-related JWTs from client-side code, cookies, and local storage patterns.
skills/extraction/supabase-extract-jwt/SKILL.md on GitHub (opens in a new tab) -
supabase-extract-service-key
CRITICAL - Detect if the Supabase service_role key is leaked in client-side code. This is a P0 severity issue.
skills/extraction/supabase-extract-service-key/SKILL.md on GitHub (opens in a new tab) -
supabase-extract-url
Extract the Supabase project URL from client-side JavaScript code, environment variables, and configuration files.
skills/extraction/supabase-extract-url/SKILL.md on GitHub (opens in a new tab) -
supabase-help
Quick reference for all Supabase security audit skills with usage examples and command overview.
skills/orchestration/supabase-help/SKILL.md on GitHub (opens in a new tab) -
supabase-pentest
Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.
skills/orchestration/supabase-pentest/SKILL.md on GitHub (opens in a new tab) -
supabase-report-compare
Compare two security audit reports to track remediation progress and identify new vulnerabilities.
skills/report/supabase-report-compare/SKILL.md on GitHub (opens in a new tab) -
supabase-report
Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.
skills/report/supabase-report/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.
Similar skills
-
cherry-studioby CherryHQ AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs
-
CowAgentby zhayujie Open-source personal AI assistant & Agent Harness. Plans tasks, runs tools and skills, self-evolves with memory and knowledge. Multi-agent,…
-
guizang-ppt-skillby op7418 AI-agent Skill for generating polished HTML slide decks: editorial magazine and Swiss layouts, image prompts, social covers, and a WebGL/lo…
-
ai-guideby liyupi 程序员鱼皮的 AI 资源大全 + Vibe Coding 零基础教程，分享 OpenClaw 保姆级教程、大模型玩法（DeepSeek / GPT / Gemini / Claude / GLM）、最新 AI 资讯、Prompt 提示词大全、AI 知识百科（Agent Skil…
-
ego-liteby citrolabs The fastest browser for AI agents to run browser automation, built for sharing your logged-in browser state with your AI agents, like Codex…
-
cc-hahaby NanmiCoder 本地优先的跨平台 Claude Code / AI Agent 桌面工作台：多 Agent 协作、Git Worktree、代码 Diff、技能市场、多模型、Computer Use、桌面宠物；支持微信、飞书、钉钉及 H5 等远程访问。 | Local-first Claude…