scan-fase-5

Identify authentication weaknesses in Supabase-backed apps across signup, login, password reset, and OAuth flows.

Updated Mar 11, 2026
One-click install
npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-5
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: scan-fase-5
Source: https://github.com/ricardoo022/PentestAI-with-claude-code/tree/main/.claude/skills/scan-fase-5
Command: npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-5

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Execute thorough authentication testing to identify misconfigurations, weak policies, and vulnerability paths in Supabase-backed applications, reducing risk of credential abuse, account enumeration, and abuse of auth endpoints.

Core Features & Use Cases

  • Auth settings discovery and policy analysis across signup, login, password reset, and OAuth flows.
  • Detection of user enumeration vectors, timing-based leaks, rate-limiting gaps, and email bombing potential.
  • Actionable remediation guidance and evidence-backed PoCs to harden authentication workflows.

Quick Start

Run the /scan-fase-5 {url} workflow against your Supabase-powered app to evaluate auth configurations and endpoints.

Frequently Asked Questions about scan-fase-5

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test Supabase authentication for user enumeration and timing attacks?

Testing Supabase authentication involves evaluating signup, login, password reset, and OAuth flows to detect user enumeration vectors and timing-based leaks. This process identifies misconfigurations in auth policies and provides actionable remediation guidance to harden authentication workflows.

What is the best way to check rate limiting gaps in Supabase auth endpoints?

The best way to check rate limiting gaps in Supabase auth endpoints is to assess authentication weaknesses across all endpoints to identify missing throttling and email abuse potential. This evaluation produces structured findings and evidence-backed PoCs suitable for remediation planning.

Can I use automated security testing to find weak policies in Supabase OAuth flows?

Yes, automated security testing can find weak policies in Supabase OAuth flows by adapting to target configurations and evaluating authentication settings. It discovers misconfigurations, weak policies, and vulnerability paths to reduce the risk of credential abuse across your application.

How do I exploit email bombing potential in Supabase password reset endpoints?

To assess email bombing potential in Supabase password reset endpoints, you identify authentication weaknesses and rate-limiting gaps across endpoints. This assessment evaluates email abuse vectors to produce structured findings and actionable mitigations for hardening the reset workflow.

Does Supabase authentication testing require specific dependencies or components?

No, Supabase authentication testing does not require specific dependencies or components, as the evaluation adapts to target configurations. You can run the workflow directly against your Supabase-powered app URL to evaluate auth configurations and endpoints without additional setup.