skills.rest
ricardoo022
ricardoo022COMMUNITY
Explore all skills by this author →
GitHub

scan-fase-4

Enumerate Supabase buckets, edge functions, and RPC endpoints for unauthorized access.

Updated Mar 11, 2026
Search Tags:#vulnerability#rls#supabase#storage#rpc#edge-functions#security-testing
One-click install
npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-4
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: scan-fase-4
Source: https://github.com/ricardoo022/PentestAI-with-claude-code/tree/main/.claude/skills/scan-fase-4
Command: npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-4

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Storage and function misconfigurations in Supabase projects can lead to data exposure or unauthorized access. This skill provides a rigorous, adaptive workflow to enumerate buckets, discover edge and RPC functions, and validate access controls across FASE 4.

Core Features & Use Cases

  • Enumerate all storage buckets and their permissions
  • Discover edge functions and RPC functions and test unauthorized access
  • Validate bucket/object access controls, RLS, and signed URLs
  • Produce structured outputs with findings and remediation guidance

Quick Start

Run /scan-fase-4 {url} after FASE 0-3 completion to begin tests against the target application.

Frequently Asked Questions about scan-fase-4

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test Supabase storage buckets for unauthorized access and RLS misconfigurations?▼

Supabase edge function and RPC security testing discovers deployed endpoints and evaluates them for unauthorized access vulnerabilities. It authenticates and tests these functions to detect misconfigurations across the application backend.

How do I test Supabase edge functions and RPC endpoints for security vulnerabilities?▼

Supabase edge function and RPC security testing discovers deployed endpoints and evaluates them for unauthorized access vulnerabilities. It authenticates and tests these functions to detect misconfigurations across the application backend.

What is the best way to enumerate and validate access controls on Supabase buckets and functions end-to-end?▼

Supabase security testing requires completing FASE 0 through FASE 3 workflows to gather target application assets and context. Running the scan against a URL after these phases ensures accurate enumeration and access validation.

Do I need to complete prior FASE workflows before testing Supabase storage and functions?▼

Supabase security testing requires completing FASE 0 through FASE 3 workflows to gather target application assets and context. Running the scan against a URL after these phases ensures accurate enumeration and access validation.

Can I get structured findings and remediation guidance for Supabase storage and function misconfigurations?▼

Supabase security testing outputs structured findings that detail discovered misconfigurations in buckets, edge functions, and RPC endpoints. The results include specific remediation guidance to resolve data exposure and unauthorized access issues.

Related Skills

Explore More Software Engineering Skills→
ricardoo022ricardoo022

scan-fase-15

Run FASE 15 supplemental scans combining Nuclei, Retire.js, Arjun, SQLMap, and Commix.

Community
Advanced
xalgordxalgord
846

supabase

Detect misconfigurations and vulnerabilities in Supabase deployments.

Community
Advanced
manuelbrandner85manuelbrandner85

supabase

Manage Supabase project lifecycle, schema migrations, and security policies.

Community
Advanced
ncvglncvgl
285

deploy-slawk

Automate Slawk deployment to Google Cloud Platform with Cloud Run and Cloud SQL.

Community
Advanced