name: supabase-help
description: Quick reference for all Supabase security audit skills with usage examples and command overview.
Supabase Pentest Skills Help
Quick reference for all 24 security audit skills.
When to Use This Skill
- Need a quick overview of available skills
- Looking for the right skill for a specific task
- Want usage examples for a particular skill
Quick Start
# Full guided audit
/supabase-pentest https://myapp.example.com
# Check if app uses Supabase
/supabase-detect https://myapp.example.com
# Generate report from previous audit
/supabase-report
All Skills Reference
Orchestration
| Skill |
Command |
Purpose |
supabase-pentest |
/supabase-pentest <url> |
Full guided security audit |
supabase-evidence |
/supabase-evidence |
Initialize evidence collection |
supabase-help |
/supabase-help |
This help reference |
Detection
| Skill |
Command |
Purpose |
supabase-detect |
/supabase-detect <url> |
Detect Supabase usage |
Extraction
| Skill |
Command |
Purpose |
supabase-extract-url |
/supabase-extract-url <url> |
Find Supabase project URL |
supabase-extract-anon-key |
/supabase-extract-anon-key |
Extract anon API key |
supabase-extract-service-key |
/supabase-extract-service-key |
Find leaked service key |
supabase-extract-jwt |
/supabase-extract-jwt |
Extract JWTs from code |
supabase-extract-db-string |
/supabase-extract-db-string |
Find DB connection strings |
API Audit
| Skill |
Command |
Purpose |
supabase-audit-tables-list |
/supabase-audit-tables-list |
List exposed tables |
supabase-audit-tables-read |
/supabase-audit-tables-read |
Read table data |
supabase-audit-rls |
/supabase-audit-rls |
Test RLS policies |
supabase-audit-rpc |
/supabase-audit-rpc |
Test RPC functions |
Storage Audit
| Skill |
Command |
Purpose |
supabase-audit-buckets-list |
/supabase-audit-buckets-list |
List storage buckets |
supabase-audit-buckets-read |
/supabase-audit-buckets-read |
Read bucket files |
supabase-audit-buckets-public |
/supabase-audit-buckets-public |
Find public buckets |
Auth Audit
| Skill |
Command |
Purpose |
supabase-audit-auth-config |
/supabase-audit-auth-config |
Check auth settings |
supabase-audit-auth-signup |
/supabase-audit-auth-signup |
Test signup access |
supabase-audit-auth-users |
/supabase-audit-auth-users |
Test user enumeration |
supabase-audit-authenticated |
/supabase-audit-authenticated |
Create test user to detect IDOR |
Realtime & Functions
| Skill |
Command |
Purpose |
supabase-audit-realtime |
/supabase-audit-realtime |
Test Realtime channels |
supabase-audit-functions |
/supabase-audit-functions |
Test Edge Functions |
Reporting
| Skill |
Command |
Purpose |
supabase-report |
/supabase-report |
Generate Markdown report |
supabase-report-compare |
/supabase-report-compare <old> <new> |
Compare two reports |
Severity Levels
| Level |
Color |
Description |
| P0 |
🔴 |
Critical: data exposure, user data, privilege escalation |
| P1 |
🟠 |
High: sensitive data, security misconfiguration |
| P2 |
🟡 |
Medium: minor exposure, best practice violations |
Common Workflows
Quick Security Check
1. /supabase-detect https://myapp.com
2. /supabase-extract-anon-key
3. /supabase-audit-rls
4. /supabase-report
Full Audit
1. /supabase-pentest https://myapp.com
(Follow guided prompts through all phases)
Storage-Only Audit
1. /supabase-detect https://myapp.com
2. /supabase-audit-buckets-list
3. /supabase-audit-buckets-public
4. /supabase-report
Compare After Fixes
1. Copy previous report to reports/audit-v1.md
2. Run new audit: /supabase-pentest https://myapp.com
3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md
Files and Directories Created
| File/Directory |
Description |
.sb-pentest-context.json |
Shared context between skills |
.sb-pentest-audit.log |
Action log with timestamps |
.sb-pentest-evidence/ |
Evidence directory for professional audits |
supabase-audit-report.md |
Final security report |
Evidence Directory Structure
.sb-pentest-evidence/
├── README.md # Evidence index
├── curl-commands.sh # Reproducible commands
├── timeline.md # Chronological findings
├── 01-detection/ # Detection evidence
├── 02-extraction/ # Key extraction evidence
├── 03-api-audit/ # API audit evidence
├── 04-storage-audit/ # Storage audit evidence
├── 05-auth-audit/ # Auth audit evidence
├── 06-realtime-audit/ # Realtime audit evidence
├── 07-functions-audit/ # Functions audit evidence
└── screenshots/ # Optional screenshots
Tips
- Always run detection first — Most skills auto-invoke it, but it's faster to run explicitly
- Check the context file — If a skill behaves unexpectedly, the context may have stale data
- Use the orchestrator for full audits — It handles dependencies automatically
- Save reports with dates — Rename
supabase-audit-report.md to include the date for history
Need More Help?
- Each skill has detailed documentation — run
/supabase-<skill-name> for specifics
- Check the README at the repository root
- Open an issue on GitHub for bugs or feature requests
By