supabase-help
Quick reference for all Supabase security audit skills with usage examples and command overview.
- Installs
- 506
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-help- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads supabase-help automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Supabase Pentest Skills Help
Quick reference for all 24 security audit skills.
When to Use This Skill
- Need a quick overview of available skills
- Looking for the right skill for a specific task
- Want usage examples for a particular skill
Quick Start
# Full guided audit
/supabase-pentest https://myapp.example.com
# Check if app uses Supabase
/supabase-detect https://myapp.example.com
# Generate report from previous audit
/supabase-report
All Skills Reference
Orchestration
| Skill | Command | Purpose |
|---|---|---|
supabase-pentest | /supabase-pentest <url> | Full guided security audit |
supabase-evidence | /supabase-evidence | Initialize evidence collection |
supabase-help | /supabase-help | This help reference |
Detection
| Skill | Command | Purpose |
|---|---|---|
supabase-detect | /supabase-detect <url> | Detect Supabase usage |
Extraction
| Skill | Command | Purpose |
|---|---|---|
supabase-extract-url | /supabase-extract-url <url> | Find Supabase project URL |
supabase-extract-anon-key | /supabase-extract-anon-key | Extract anon API key |
supabase-extract-service-key | /supabase-extract-service-key | Find leaked service key |
supabase-extract-jwt | /supabase-extract-jwt | Extract JWTs from code |
supabase-extract-db-string | /supabase-extract-db-string | Find DB connection strings |
API Audit
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-tables-list | /supabase-audit-tables-list | List exposed tables |
supabase-audit-tables-read | /supabase-audit-tables-read | Read table data |
supabase-audit-rls | /supabase-audit-rls | Test RLS policies |
supabase-audit-rpc | /supabase-audit-rpc | Test RPC functions |
Storage Audit
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-buckets-list | /supabase-audit-buckets-list | List storage buckets |
supabase-audit-buckets-read | /supabase-audit-buckets-read | Read bucket files |
supabase-audit-buckets-public | /supabase-audit-buckets-public | Find public buckets |
Auth Audit
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-auth-config | /supabase-audit-auth-config | Check auth settings |
supabase-audit-auth-signup | /supabase-audit-auth-signup | Test signup access |
supabase-audit-auth-users | /supabase-audit-auth-users | Test user enumeration |
supabase-audit-authenticated | /supabase-audit-authenticated | Create test user to detect IDOR |
Realtime & Functions
| Skill | Command | Purpose |
|---|---|---|
supabase-audit-realtime | /supabase-audit-realtime | Test Realtime channels |
supabase-audit-functions | /supabase-audit-functions | Test Edge Functions |
Reporting
| Skill | Command | Purpose |
|---|---|---|
supabase-report | /supabase-report | Generate Markdown report |
supabase-report-compare | /supabase-report-compare <old> <new> | Compare two reports |
Severity Levels
| Level | Color | Description |
|---|---|---|
| P0 | 🔴 | Critical: data exposure, user data, privilege escalation |
| P1 | 🟠 | High: sensitive data, security misconfiguration |
| P2 | 🟡 | Medium: minor exposure, best practice violations |
Common Workflows
Quick Security Check
1. /supabase-detect https://myapp.com
2. /supabase-extract-anon-key
3. /supabase-audit-rls
4. /supabase-report
Full Audit
1. /supabase-pentest https://myapp.com
(Follow guided prompts through all phases)
Storage-Only Audit
1. /supabase-detect https://myapp.com
2. /supabase-audit-buckets-list
3. /supabase-audit-buckets-public
4. /supabase-report
Compare After Fixes
1. Copy previous report to reports/audit-v1.md
2. Run new audit: /supabase-pentest https://myapp.com
3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md
Files and Directories Created
| File/Directory | Description |
|---|---|
.sb-pentest-context.json | Shared context between skills |
.sb-pentest-audit.log | Action log with timestamps |
.sb-pentest-evidence/ | Evidence directory for professional audits |
supabase-audit-report.md | Final security report |
Evidence Directory Structure
.sb-pentest-evidence/
├── README.md # Evidence index
├── curl-commands.sh # Reproducible commands
├── timeline.md # Chronological findings
├── 01-detection/ # Detection evidence
├── 02-extraction/ # Key extraction evidence
├── 03-api-audit/ # API audit evidence
├── 04-storage-audit/ # Storage audit evidence
├── 05-auth-audit/ # Auth audit evidence
├── 06-realtime-audit/ # Realtime audit evidence
├── 07-functions-audit/ # Functions audit evidence
└── screenshots/ # Optional screenshots
Tips
- Always run detection first — Most skills auto-invoke it, but it's faster to run explicitly
- Check the context file — If a skill behaves unexpectedly, the context may have stale data
- Use the orchestrator for full audits — It handles dependencies automatically
- Save reports with dates — Rename
supabase-audit-report.mdto include the date for history
Need More Help?
- Each skill has detailed documentation — run
/supabase-<skill-name>for specifics - Check the README at the repository root
- Open an issue on GitHub for bugs or feature requests
FAQ
What does the supabase-help skill do?
Quick reference for all Supabase security audit skills with usage examples and command overview.
How do I install supabase-help?
Run npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-help in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/supabase-help/ (personal) or .claude/skills/supabase-help/ (project).
Which AI agents can use supabase-help?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is supabase-help safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains supabase-help?
It is published by yoanbernabeu in yoanbernabeu/supabase-pentest-skills. It has 506 recorded installs.
More from yoanbernabeu/supabase-pentest-skills
supabase-audit-rls
yoanbernabeu/supabase-pentest-skills
Test Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.
supabase-audit-functions
yoanbernabeu/supabase-pentest-skills
Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.
supabase-pentest
yoanbernabeu/supabase-pentest-skills
Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.
supabase-audit-auth-config
yoanbernabeu/supabase-pentest-skills
Analyze Supabase authentication configuration for security weaknesses and misconfigurations.
supabase-audit-rpc
yoanbernabeu/supabase-pentest-skills
List and test exposed PostgreSQL RPC functions for security issues and potential RLS bypass.
supabase-audit-realtime
yoanbernabeu/supabase-pentest-skills
Test Supabase Realtime WebSocket channels for unauthorized subscriptions and data exposure.
Popular data & databases skills
supabase-postgres-best-practices
supabase/agent-skills
Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill BEFORE writing or changing anything that lives in a Postgres database: creating or altering tables and columns (including choosing column types), schema design, migrations and declarative schema files, RLS policies and the tests that verify them, indexes, triggers, database functions, queues and scheduled jobs (pgcron, pgmq), vector/semantic search (pgvector), and restoring dumps (pgrestore) or importing data. Also load it when diagnosing slow queries, high CPU, timeouts, EXPLAIN plans, connection exhaustion, locking, bloat, or rows visible to the wrong user or tenant. This is not just a performance guide — schema, migration, security, and SQL authoring tasks need these rules too, even for a one-column change or a single query.
prisma-client-api
prisma/skills
Prisma Client API reference covering model queries, filters, operators, and client methods. Use when writing database queries, using CRUD operations, filtering data, or configuring Prisma Client. Triggers on "prisma query", "findMany", "create", "update", "delete", "$transaction".
prisma-database-setup
prisma/skills
Deprecated compatibility name for prisma-orm-setup. Use only when a user or existing integration explicitly invokes prisma-database-setup; otherwise select prisma-orm-setup.
prisma-cli
prisma/skills
Prisma ORM 7 CLI reference for existing Prisma 7 applications or explicitly selected Prisma 7 workflows. Covers prisma init, generate, migrate, db, dev, studio, and mcp. For setup, connection repair, or Prisma 8, use prisma-orm-setup; not the Prisma Platform CLI.
prisma-postgres
prisma/skills
Deprecated compatibility name for prisma-postgres-setup. Use only when a user or existing integration explicitly invokes prisma-postgres; otherwise select prisma-postgres-setup.
prisma-driver-adapter-implementation
prisma/skills
Required reference for Prisma ORM 7 SQL driver adapter work. Use when implementing or modifying adapters, adding database drivers, or touching SqlDriverAdapter, Transaction, savepoint, result mapping, or DriverAdapterError behavior. Covers current transaction lifecycle, optional savepoint hooks, original database-error preservation, and verification.