Supabase Help

yoanbernabeu/supabase-pentest-skills/skills/orchestration/supabase-help

作者 yoanbernabeu0f9612276b49f241584f9d779767e35ae519875a無授權條款收錄於 2026年10月9日更新於 2026年10月9日

Quick reference for all Supabase security audit skills with usage examples and command overview.

僅含說明Security AI & Agents

AI 產生的概覽

列出 Supabase 安全稽核技能、指令、工作流程與報告產物的參考指南。

功能: 此技能是 24 個 Supabase 安全稽核技能的說明參考。它依協調、偵測、擷取、API、儲存、驗證、即時、函式與報告等類別列出各技能的指令與用途，並說明嚴重性等級、常見工作流程，以及稽核產生的脈絡、日誌、證據與報告檔案。它輸出的是指引文字，本身不執行稽核。
適用情境: 當你需要概覽可用的 Supabase 稽核技能、為特定稽核任務尋找合適的技能，或在執行稽核前需要用法範例與工作流程順序時使用。
執行需求: 無需指令碼或特殊工具，僅為說明性參考。它記錄的稽核技能針對 Supabase 專案，可能需要網路存取與目標網址，但此說明技能本身除代理外無需其他條件。

Supabase Pentest Skills Help

Quick reference for all 24 security audit skills.

When to Use This Skill

Need a quick overview of available skills
Looking for the right skill for a specific task
Want usage examples for a particular skill

Quick Start

bash

# Full guided audit/supabase-pentest https://myapp.example.com
# Check if app uses Supabase/supabase-detect https://myapp.example.com
# Generate report from previous audit/supabase-report

# Full guided audit/supabase-pentest https://myapp.example.com
# Check if app uses Supabase/supabase-detect https://myapp.example.com
# Generate report from previous audit/supabase-report

All Skills Reference

Orchestration

Detection

Extraction

Skill	Command	Purpose
`supabase-extract-url`	`/supabase-extract-url <url>`	Find Supabase project URL
`supabase-extract-anon-key`	`/supabase-extract-anon-key`	Extract anon API key
`supabase-extract-service-key`	`/supabase-extract-service-key`	Find leaked service key
`supabase-extract-jwt`	`/supabase-extract-jwt`	Extract JWTs from code
`supabase-extract-db-string`	`/supabase-extract-db-string`	Find DB connection strings

API Audit

Skill	Command	Purpose
`supabase-audit-tables-list`	`/supabase-audit-tables-list`	List exposed tables
`supabase-audit-tables-read`	`/supabase-audit-tables-read`	Read table data
`supabase-audit-rls`	`/supabase-audit-rls`	Test RLS policies
`supabase-audit-rpc`	`/supabase-audit-rpc`	Test RPC functions

Storage Audit

Skill	Command	Purpose
`supabase-audit-buckets-list`	`/supabase-audit-buckets-list`	List storage buckets
`supabase-audit-buckets-read`	`/supabase-audit-buckets-read`	Read bucket files
`supabase-audit-buckets-public`	`/supabase-audit-buckets-public`	Find public buckets

Auth Audit

Skill	Command	Purpose
`supabase-audit-auth-config`	`/supabase-audit-auth-config`	Check auth settings
`supabase-audit-auth-signup`	`/supabase-audit-auth-signup`	Test signup access
`supabase-audit-auth-users`	`/supabase-audit-auth-users`	Test user enumeration
`supabase-audit-authenticated`	`/supabase-audit-authenticated`	Create test user to detect IDOR

Realtime & Functions

Reporting

Severity Levels

Common Workflows

Quick Security Check

1. /supabase-detect https://myapp.com2. /supabase-extract-anon-key3. /supabase-audit-rls4. /supabase-report

1. /supabase-detect https://myapp.com2. /supabase-extract-anon-key3. /supabase-audit-rls4. /supabase-report

Full Audit

Storage-Only Audit

1. /supabase-detect https://myapp.com2. /supabase-audit-buckets-list3. /supabase-audit-buckets-public4. /supabase-report

1. /supabase-detect https://myapp.com2. /supabase-audit-buckets-list3. /supabase-audit-buckets-public4. /supabase-report

Compare After Fixes

1. Copy previous report to reports/audit-v1.md2. Run new audit: /supabase-pentest https://myapp.com3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md

1. Copy previous report to reports/audit-v1.md2. Run new audit: /supabase-pentest https://myapp.com3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md

Files and Directories Created

File/Directory	Description
`.sb-pentest-context.json`	Shared context between skills
`.sb-pentest-audit.log`	Action log with timestamps
`.sb-pentest-evidence/`	Evidence directory for professional audits
`supabase-audit-report.md`	Final security report

Evidence Directory Structure

.sb-pentest-evidence/├── README.md                 # Evidence index├── curl-commands.sh          # Reproducible commands├── timeline.md               # Chronological findings├── 01-detection/             # Detection evidence├── 02-extraction/            # Key extraction evidence├── 03-api-audit/             # API audit evidence├── 04-storage-audit/         # Storage audit evidence├── 05-auth-audit/            # Auth audit evidence├── 06-realtime-audit/        # Realtime audit evidence├── 07-functions-audit/       # Functions audit evidence└── screenshots/              # Optional screenshots

.sb-pentest-evidence/├── README.md                 # Evidence index├── curl-commands.sh          # Reproducible commands├── timeline.md               # Chronological findings├── 01-detection/             # Detection evidence├── 02-extraction/            # Key extraction evidence├── 03-api-audit/             # API audit evidence├── 04-storage-audit/         # Storage audit evidence├── 05-auth-audit/            # Auth audit evidence├── 06-realtime-audit/        # Realtime audit evidence├── 07-functions-audit/       # Functions audit evidence└── screenshots/              # Optional screenshots

Tips

Always run detection first — Most skills auto-invoke it, but it's faster to run explicitly
Check the context file — If a skill behaves unexpectedly, the context may have stale data
Use the orchestrator for full audits — It handles dependencies automatically
Save reports with dates — Rename supabase-audit-report.md to include the date for history

Need More Help?

Each skill has detailed documentation — run /supabase-<skill-name> for specifics
Check the README at the repository root
Open an issue on GitHub for bugs or feature requests

來源與署名

來源：yoanbernabeu/supabase-pentest-skills位於skills/orchestration/supabase-help提交0f96122

授權條款：無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Skill	Command	Purpose
`supabase-pentest`	`/supabase-pentest <url>`	Full guided security audit
`supabase-evidence`	`/supabase-evidence`	Initialize evidence collection
`supabase-help`	`/supabase-help`	This help reference

Skill	Command	Purpose
`supabase-audit-realtime`	`/supabase-audit-realtime`	Test Realtime channels
`supabase-audit-functions`	`/supabase-audit-functions`	Test Edge Functions

Skill	Command	Purpose
`supabase-report`	`/supabase-report`	Generate Markdown report
`supabase-report-compare`	`/supabase-report-compare <old> <new>`	Compare two reports

Level	Color	Description
P0	🔴	Critical: data exposure, user data, privilege escalation
P1	🟠	High: sensitive data, security misconfiguration
P2	🟡	Medium: minor exposure, best practice violations

Supabase Help

Supabase Pentest Skills Help

When to Use This Skill

Quick Start

All Skills Reference

Orchestration

Detection

Extraction

API Audit

Storage Audit

Auth Audit

Realtime & Functions

Reporting

Severity Levels

Common Workflows

Quick Security Check

Full Audit

Storage-Only Audit

Compare After Fixes

Files and Directories Created

Evidence Directory Structure

Tips

Need More Help?

來源與署名

更多來自 yoanbernabeu/supabase-pentest-skills 的技能

Supabase Extract Jwt

Supabase Report Compare

Supabase Pentest

Supabase Audit Tables Read

Supabase Detect

Supabase Audit Realtime

更多Security技能

Kyc Rules

Kyc Rules

Compliance Tracking

Google Cloud Scc Remediation

Google Cloud Recipe Auth

Dpop Adoption