Supabase Pentest Skills Help

Quick reference for all 24 security audit skills.

When to Use This Skill

• Need a quick overview of available skills
• Looking for the right skill for a specific task
• Want usage examples for a particular skill

Quick Start

# Full guided audit
/supabase-pentest https://myapp.example.com

# Check if app uses Supabase
/supabase-detect https://myapp.example.com

# Generate report from previous audit
/supabase-report

All Skills Reference

Orchestration

Detection

Extraction

API Audit

Storage Audit

Auth Audit

Realtime & Functions

Reporting

Severity Levels

Common Workflows

Quick Security Check

1. /supabase-detect https://myapp.com
2. /supabase-extract-anon-key
3. /supabase-audit-rls
4. /supabase-report

Full Audit

1. /supabase-pentest https://myapp.com
   (Follow guided prompts through all phases)

Storage-Only Audit

1. /supabase-detect https://myapp.com
2. /supabase-audit-buckets-list
3. /supabase-audit-buckets-public
4. /supabase-report

Compare After Fixes

1. Copy previous report to reports/audit-v1.md
2. Run new audit: /supabase-pentest https://myapp.com
3. /supabase-report-compare reports/audit-v1.md supabase-audit-report.md

Files and Directories Created

Evidence Directory Structure

.sb-pentest-evidence/
├── README.md                 # Evidence index
├── curl-commands.sh          # Reproducible commands
├── timeline.md               # Chronological findings
├── 01-detection/             # Detection evidence
├── 02-extraction/            # Key extraction evidence
├── 03-api-audit/             # API audit evidence
├── 04-storage-audit/         # Storage audit evidence
├── 05-auth-audit/            # Auth audit evidence
├── 06-realtime-audit/        # Realtime audit evidence
├── 07-functions-audit/       # Functions audit evidence
└── screenshots/              # Optional screenshots

Tips

1. Always run detection first — Most skills auto-invoke it, but it’s faster to run explicitly
2. Check the context file — If a skill behaves unexpectedly, the context may have stale data
3. Use the orchestrator for full audits — It handles dependencies automatically
4. Save reports with dates — Rename supabase-audit-report.md to include the date for history

Need More Help?

• Each skill has detailed documentation — run /supabase-<skill-name> for specifics
• Check the README at the repository root
• Open an issue on GitHub for bugs or feature requests