supabase-pentest-skills skill by reason-machines

Supabase Pentest Skills

Skill by ara.so — Security Skills collection.

A comprehensive toolkit of 24 AI agent skills for professional security auditing of Supabase applications. Automates detection, credential extraction, Row Level Security (RLS) testing, IDOR detection, storage audits, authentication analysis, and comprehensive reporting.

What This Project Does

Supabase Pentest Skills is a modular security auditing framework designed for internal self-assessment by authorized development teams. It provides:

Detection: Identify Supabase usage from public URLs
Extraction: Discover exposed API keys, JWTs, service keys, and database connection strings
API Audit: Test PostgREST endpoints, RLS policies, and RPC functions
Storage Audit: Identify misconfigured buckets and unauthorized file access
Auth Audit: Test authentication flows, user enumeration, and IDOR vulnerabilities
Evidence Collection: Professional-grade logging and proof-of-concept documentation
Reporting: Generate detailed Markdown reports with severity ratings and remediation guidance

Important: These skills are for authorized testing only. You must own or have explicit permission to audit the target application.

Installation

Quick Install (All 24 Skills)

npx skills add yoanbernabeu/supabase-pentest-skills

Install Specific Skill Packs

# Detection only
npx skills add yoanbernabeu/supabase-pentest-skills

List Available Skills

Recommended Professional Setup

For complete audit trail and evidence collection:

Core Skills Reference

Orchestration & Evidence

Skill	Purpose
`supabase-pentest`	Main orchestrator — guided step-by-step audit
`supabase-evidence`	Initialize professional evidence collection
`supabase-help`	Quick reference guide

Detection & Extraction

Skill	Purpose
`supabase-detect`	Detect Supabase usage from HTML/JS
`supabase-extract-url`	Extract project URL
`supabase-extract-anon-key`	Extract anon/public API key
`supabase-extract-service-key`	Critical: Detect leaked service_role key
`supabase-extract-jwt`	Extract and decode JWTs
`supabase-extract-db-string`	Detect exposed database connection strings

API & RLS Testing

Skill	Purpose
`supabase-audit-tables-list`	List exposed PostgREST tables
`supabase-audit-tables-read`	Attempt data reads
`supabase-audit-rls`	Test Row Level Security policies
`supabase-audit-rpc`	Test exposed RPC functions

Storage & Auth

Skill	Purpose
`supabase-audit-buckets-list`	List storage buckets
`supabase-audit-buckets-read`	Test file access
`supabase-audit-buckets-public`	Detect public bucket misconfigurations
`supabase-audit-auth-config`	Analyze auth configuration
`supabase-audit-auth-signup`	Test open signup
`supabase-audit-auth-users`	Test user enumeration
`supabase-audit-authenticated`	Create test user to detect IDOR

Realtime, Functions & Reporting

Skill	Purpose
`supabase-audit-realtime`	Test Realtime channels
`supabase-audit-functions`	Test Edge Functions
`supabase-report`	Generate comprehensive report
`supabase-report-compare`	Compare two audit reports

Usage Patterns

Pattern 1: Full Guided Audit

The orchestrator will:

Initialize evidence collection
Run detection and extraction
Execute all API, storage, auth audits
Generate comprehensive report with severity ratings

Pattern 2: Targeted Extraction

This will run:

supabase-detect
supabase-extract-url
supabase-extract-anon-key
supabase-extract-service-key (critical check)
supabase-extract-jwt
supabase-extract-db-string

Pattern 3: RLS Policy Testing

This will:

Extract credentials
List tables (supabase-audit-tables-list)
Attempt unauthorized reads (supabase-audit-tables-read)
Test RLS bypass scenarios (supabase-audit-rls)

Pattern 4: IDOR Detection

This executes supabase-audit-authenticated, which:

Creates a test user
Attempts cross-user data access
Tests privilege escalation
Documents findings with proof-of-concept

Pattern 5: Storage Security Audit

Runs:

supabase-audit-buckets-list
supabase-audit-buckets-read
supabase-audit-buckets-public

Pattern 6: Compare Progress

Uses supabase-report-compare to show:

New vulnerabilities discovered
Issues resolved
Security score changes

Context & Evidence Files

All skills share state through files:

`.sb-pentest-context.json`

`.sb-pentest-audit.log`

`.sb-pentest-evidence/` Directory Structure

`curl-commands.sh` (Reproducible Tests)

Report Format

Example Output (`supabase-audit-report.md`)

# Supabase Security Audit Report
 
**Target**: https://myapp.example.com
**Supabase Project**: https://abc123.supabase.co
**Date**: 2025-01-31
**Auditor**: AI Agent (supabase-pentest-skills)
 
---
 
## Executive Summary
 
**Security Score**: 45/100 (Grade: D)
 
- **2 P0 (Critical)** issues found
- **3 P1 (High)** issues found
- **5 P2 (Medium)** issues found
 
**Risk Level**: HIGH — Immediate action required
 
### Key Risks
1. Service role key exposed in client code (full DB access)
2. Row Level Security disabled on `users` table
3. IDOR vulnerability allows cross-user data access
 
---
 
## Critical Findings (P0)
 
### 1. Service Role Key Exposed in Client Code
 
**Severity**: P0 - Critical  
**Location**: `/static/js/main.js:1247`  
**Impact**: Full database access bypassing all RLS policies
 
**Evidence**:
```javascript
const supabase = createClient(
  'https://abc123.supabase.co',
  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIn0...'
  // ^ This is a service_role key!
)

Remediation:

Rotate the service_role key immediately in Supabase Dashboard > Settings > API
Remove from client code
Use anon key in client, service key ONLY in secure backend/Edge Functions

References:

2. Row Level Security Disabled on `users` Table

Severity: P0 - Critical
Impact: All user data readable/writable by anyone with anon key

Test Result:

curl 'https://abc123.supabase.co/rest/v1/users?select=*' \
  -H "apikey: ANON_KEY" \
  # Returns ALL users including emails, phone numbers, metadata

Remediation:

-- Enable RLS
ALTER TABLE users ENABLE ROW LEVEL SECURITY;
 
-- Policy: Users can only read their own data
CREATE POLICY "Users can view own data"
  ON users FOR SELECT
  USING (auth.uid() = id);
 
-- Policy: Users can update their own data
CREATE POLICY "Users can update own data"
  ON users FOR UPDATE
  USING (auth.uid() = id);

High Priority Findings (P1)

1. Public Storage Bucket Misconfiguration

Severity: P1 - High
Bucket: avatars
Impact: All uploaded avatars accessible without authentication

Test:

curl 'https://abc123.supabase.co/storage/v1/object/public/avatars/user-456/avatar.jpg'
# Returns file without auth

Remediation:

Make bucket private if files should be protected
Use signed URLs for temporary access
Implement storage policies:

CREATE POLICY "Avatar access policy"
  ON storage.objects FOR SELECT
  USING (
    bucket_id = 'avatars' AND
    (storage.foldername(name))[1] = auth.uid()::text
  );

Medium Priority Findings (P2)

1. Verbose Error Messages Expose Schema

Severity: P2 - Medium
Impact: Attackers can enumerate table structure

Example:

POST /rest/v1/users
Response: "column 'internal_admin_flag' does not exist"

Remediation: Configure PostgREST to return generic errors in production

Remediation Checklist

Next Steps

Address all P0 issues immediately
Re-run audit with: /supabase-pentest after fixes
Compare reports: supabase-report-compare old-report.md new-report.md
Establish continuous security testing in CI/CD

Generated by: supabase-pentest-skills v1.0
Evidence: See .sb-pentest-evidence/ directory
Reproducible Tests: .sb-pentest-evidence/curl-commands.sh

 
## Configuration
 
### Environment Variables
 
Skills use context files instead of environment variables. However, you can configure:
 
```bash
# Target URL (overrides prompt)
export SUPABASE_PENTEST_TARGET="https://myapp.example.com"
 
# Skip confirmation prompts (CI/CD)
export SUPABASE_PENTEST_AUTO_CONFIRM="true"
 
# Custom evidence directory
export SUPABASE_PENTEST_EVIDENCE_DIR="./security-audit-evidence"

CLAUDE.md Template Configuration

The recommended template enforces:

Troubleshooting

Issue: "Supabase not detected"

Cause: Target site doesn't use Supabase or keys are dynamically loaded

Solution:

Issue: "Rate limited by Supabase API"

Cause: Too many requests in short time

Solution: Skills automatically slow down when detecting rate limits. If persistent:

Issue: "No tables found"

Cause: Either no tables exposed or API key invalid

Solution:

Issue: "Context file missing"

Cause: Skills executed out of order

Solution:

Issue: "Test user creation failed"

Cause: Signup disabled or email verification required

Solution:

Real-World Example Workflow

Prompt to AI agent:

Expected Output:

Integration with CI/CD

GitHub Actions Example

Security Best Practices

Never commit context files to version control:

echo ".sb-pentest-context.json" >> .gitignore
echo ".sb-pentest-audit.log" >> .gitignore
echo ".sb-pentest-evidence/" >> .gitignore

Always run in isolated audit directories

Delete test users after audit:

After completing the audit, delete the test user from Supabase Dashboard > Authentication > Users

Rotate keys if service_role leaked:

If P0 finding "service_role key exposed":
1. Go to Supabase Dashboard > Settings > API
2. Click "Rotate" on service_role key
3. Update all backend services immediately

Share reports securely (not via public links)

Advanced Usage

Custom Severity Thresholds

Edit findings in .sb-pentest-context.json:

{
  "custom_severity_rules": {
    "public_buckets": "P1",  // Default is P2
    "missing_rls": "P0",     // Default is P0
    "open_signup": "P2"      // Default is P1
  }
}

Exclude Specific Tests

Run Supabase audit but skip auth testing (we have SSO integration)

The orchestrator will skip auth-related skills if you specify exclusions.

Multi-Environment Testing

# Staging
mkdir staging-audit
cd staging-audit
# Run audit on https://staging.myapp.com
 
# Production
mkdir production-audit
cd production-audit
# Run audit on https://myapp.com
 
# Compare
supabase-report-compare ../staging-audit/report.md ./report.md

Legal & Ethical Considerations

✅ Authorized Use:

Internal security assessment by development teams
Pre-deployment vulnerability scanning
Compliance audits with proper authorization

❌ Unauthorized Use:

Testing applications you don't own
Testing without explicit written permission
Using findings for malicious purposes

Disclaimer: This toolkit is provided for authorized security testing only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.

Additional Resources