yoanbernabeuCommunity·24 Agent Skills Included

supabase-pentest-skills

Automated security auditing and penetration testing for Supabase apps

Audits Supabase applications for exposed keys, broken RLS policies, public storage buckets, and auth weaknesses. Detects leaked service keys, database connection strings, IDOR flaws, and privilege escalation across 24 read-only checks. Collects timestamped evidence and generates severity-ranked reports with step-by-step remediation guidance.

62|3

↗

npx skills add yoanbernabeu/supabase-pentest-skills --all -g -y

Available:

Instructs the agent to run all 24 audit skills in a fixed phase order, log every action, and save evidence progressively for compliance-grade documentation.

All Skills in This Repository (24)

Pure Emerald Level Indicators

📦 In Repo

yoanbernabeu

supabase-evidence

Initialize and manage the .sb-pentest-evidence directory with structured subfolders and templates.

supabase-audit-buckets-read

Lists and validates Supabase storage bucket access controls for public exposure.

supabase-audit-buckets-public

Identify publicly accessible storage buckets in Supabase projects.

supabase-audit-buckets-list

Enumerate Supabase storage buckets and parse their public flag, size limits, and MIME types.

supabase-audit-rls

Audit Supabase Row Level Security policies for bypass vulnerabilities and misconfigurations.

supabase-audit-tables-read

Test read access on exposed Supabase tables via REST API queries.

supabase-audit-tables-list

Enumerate Supabase tables exposed via the PostgREST/OpenAPI schema.

supabase-audit-rpc

Audit Supabase PostgreSQL RPC functions for RLS bypass and injection vulnerabilities.

supabase-audit-functions

Discover and test Supabase Edge Functions for security vulnerabilities.

supabase-pentest

Orchestrate a complete security audit of a Supabase application.

supabase-help

Access Supabase pentest skill suite commands for security audits.

supabase-report-compare

Compare two Markdown security audit reports to identify changes in findings and remediation progress.

Community

Basic

Frequently Asked Questions

FAQPage Schema

How to install Supabase Pentest Skills?▼

Run `npx skills add yoanbernabeu/supabase-pentest-skills --all -g -y` in your terminal to install all 24 skills globally.

How to run a full Supabase security audit?▼

Open your agent in a fresh directory and run /supabase-pentest with your app's public URL. The orchestrator guides you through detection, key extraction, API, storage, auth, and realtime testing phases.

Is it safe and legal to use these pentest skills?▼

Yes, all tests are read-only and every action is logged, but you must own the target application or have explicit written authorization before auditing.

What vulnerabilities can it detect in Supabase?▼

It finds leaked service keys, exposed database strings, missing RLS policies, public storage buckets, user enumeration, IDOR, and privilege escalation in Edge Functions.

Does it work with Claude Code and Cursor?▼

Yes. All skills follow the universal SKILL.md standard and run in Claude Code, Cursor, Codex, OpenCode, Windsurf, and 30+ other agents.