Supabase Help

yoanbernabeu/supabase-pentest-skills/skills/orchestration/supabase-help

作者 yoanbernabeu0f9612276b49f241584f9d779767e35ae519875a无许可证收录于 2026年10月9日更新于 2026年10月9日

Quick reference for all Supabase security audit skills with usage examples and command overview.

仅含说明SecurityAI & Agents
AI 生成的概览

列出 Supabase 安全审计技能、命令、工作流程与报告产物的参考指南。

功能
该技能是 24 个 Supabase 安全审计技能的帮助参考。它按编排、检测、提取、API、存储、认证、实时、函数和报告等类别列出各技能的命令与用途，并说明严重级别、常见工作流程，以及审计生成的上下文、日志、证据和报告文件。它输出的是指引文本，本身不执行审计。
适用场景
当你需要概览可用的 Supabase 审计技能、为特定审计任务寻找合适的技能，或在运行审计前需要用法示例和工作流程顺序时使用。
运行要求
无需脚本或特殊工具，仅为说明性参考。它记录的审计技能面向 Supabase 项目，可能需要网络访问和目标网址，但此帮助技能本身除智能体外无需其他条件。

Supabase Pentest Skills Help

Quick reference for all 24 security audit skills.

When to Use This Skill

  • Need a quick overview of available skills
  • Looking for the right skill for a specific task
  • Want usage examples for a particular skill

Quick Start

bash
# Full guided audit/supabase-pentest https://myapp.example.com
# Check if app uses Supabase/supabase-detect https://myapp.example.com
# Generate report from previous audit/supabase-report

All Skills Reference

Orchestration

SkillCommandPurpose
supabase-pentest/supabase-pentest <url>Full guided security audit
supabase-evidence/supabase-evidenceInitialize evidence collection
supabase-help/supabase-helpThis help reference

Detection

SkillCommandPurpose
supabase-detect/supabase-detect <url>Detect Supabase usage

Extraction

SkillCommandPurpose
supabase-extract-url/supabase-extract-url <url>Find Supabase project URL
supabase-extract-anon-key/supabase-extract-anon-keyExtract anon API key
supabase-extract-service-key/supabase-extract-service-keyFind leaked service key
supabase-extract-jwt/supabase-extract-jwtExtract JWTs from code
supabase-extract-db-string/supabase-extract-db-stringFind DB connection strings

API Audit

SkillCommandPurpose
supabase-audit-tables-list/supabase-audit-tables-listList exposed tables
supabase-audit-tables-read/supabase-audit-tables-readRead table data
supabase-audit-rls/supabase-audit-rlsTest RLS policies
supabase-audit-rpc/supabase-audit-rpcTest RPC functions

Storage Audit

SkillCommandPurpose
supabase-audit-buckets-list/supabase-audit-buckets-listList storage buckets
supabase-audit-buckets-read/supabase-audit-buckets-readRead bucket files
supabase-audit-buckets-public/supabase-audit-buckets-publicFind public buckets

Auth Audit

SkillCommandPurpose
supabase-audit-auth-config/supabase-audit-auth-configCheck auth settings
supabase-audit-auth-signup/supabase-audit-auth-signupTest signup access
supabase-audit-auth-users/supabase-audit-auth-usersTest user enumeration
supabase-audit-authenticated/supabase-audit-authenticatedCreate test user to detect IDOR

Realtime & Functions

SkillCommandPurpose
supabase-audit-realtime/supabase-audit-realtimeTest Realtime channels
supabase-audit-functions/supabase-audit-functionsTest Edge Functions

Reporting

SkillCommandPurpose
supabase-report/supabase-reportGenerate Markdown report
supabase-report-compare/supabase-report-compare <old> <new>Compare two reports

Severity Levels

LevelColorDescription
P0🔴Critical: data exposure, user data, privilege escalation
P1🟠High: sensitive data, security misconfiguration
P2🟡Medium: minor exposure, best practice violations

Common Workflows

Quick Security Check

1. /supabase-detect https://myapp.com2. /supabase-extract-anon-key3. /supabase-audit-rls4. /supabase-report

Full Audit

1. /supabase-pentest https://myapp.com   (Follow guided prompts through all phases)

Storage-Only Audit

1. /supabase-detect https://myapp.com2. /supabase-audit-buckets-list3. /supabase-audit-buckets-public4. /supabase-report

Compare After Fixes

1. Copy previous report to reports/audit-v1.md2. Run new audit: /supabase-pentest https://myapp.com3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md

Files and Directories Created

File/DirectoryDescription
.sb-pentest-context.jsonShared context between skills
.sb-pentest-audit.logAction log with timestamps
.sb-pentest-evidence/Evidence directory for professional audits
supabase-audit-report.mdFinal security report

Evidence Directory Structure

.sb-pentest-evidence/├── README.md                 # Evidence index├── curl-commands.sh          # Reproducible commands├── timeline.md               # Chronological findings├── 01-detection/             # Detection evidence├── 02-extraction/            # Key extraction evidence├── 03-api-audit/             # API audit evidence├── 04-storage-audit/         # Storage audit evidence├── 05-auth-audit/            # Auth audit evidence├── 06-realtime-audit/        # Realtime audit evidence├── 07-functions-audit/       # Functions audit evidence└── screenshots/              # Optional screenshots

Tips

  1. Always run detection first — Most skills auto-invoke it, but it's faster to run explicitly
  2. Check the context file — If a skill behaves unexpectedly, the context may have stale data
  3. Use the orchestrator for full audits — It handles dependencies automatically
  4. Save reports with dates — Rename supabase-audit-report.md to include the date for history

Need More Help?

  • Each skill has detailed documentation — run /supabase-<skill-name> for specifics
  • Check the README at the repository root
  • Open an issue on GitHub for bugs or feature requests

来源与署名

来源：yoanbernabeu/supabase-pentest-skills位于skills/orchestration/supabase-help提交0f96122

许可证： 无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

更多来自 yoanbernabeu/supabase-pentest-skills 的技能

Supabase Extract Jwt

yoanbernabeu

从客户端代码、Cookie 和存储模式中提取并解码与 Supabase 相关的 JWT。

Security2026年10月9日

Supabase Report Compare

yoanbernabeu

比较两份 Supabase 安全审计报告，跟踪修复进度、遗留问题和新出现的漏洞。

Security2026年10月9日

Supabase Pentest

yoanbernabeu

编排分阶段的 Supabase 安全审计，涵盖检测、密钥提取到报告生成，并跟踪证据。

Security2026年10月9日

Supabase Audit Tables Read

yoanbernabeu

测试 Supabase 暴露表的读取权限，以验证数据暴露情况和 RLS 有效性。

Security2026年10月9日

Supabase Detect

yoanbernabeu

通过扫描客户端代码、端点和响应头，检测 Web 应用是否使用 Supabase。

Security2026年10月9日

Supabase Audit Realtime

yoanbernabeu

审计 Supabase Realtime WebSocket 频道，检查未授权订阅与数据暴露。

Security2026年10月9日

更多Security技能

Kyc Rules

anthropics

精选

将公司的 KYC/AML 规则表应用于已解析的开户记录，评定风险并给出处理路由。

Security39K2周前更新

Kyc Rules

anthropics

精选

将公司的 KYC/AML 规则表应用于已解析的开户记录，评定风险并给出处理路由。

Security39K2周前更新

Compliance Tracking

anthropics

精选

跟踪合规要求、审计准备情况以及 SOC 2、ISO 27001、GDPR、HIPAA 和 PCI DSS 等框架的证据。

Security27K今天更新

Google Cloud Scc Remediation

google

精选

指导修复 Google Cloud Security Command Center 发现项，提供需用户批准的方案与参考手册。

Security21K昨天更新

Google Cloud Recipe Auth

google

精选

指导用户、服务账号和工作负载如何对 Google Cloud 服务与 API 进行身份验证和授权。

Security21K昨天更新

Dpop Adoption

google

精选

指导为 Google OAuth 平台实现 OAuth 2.0 DPoP（RFC 9449）发送方约束刷新令牌。

Security21K昨天更新