Agent skill · security · aradotso
supabase-pentest-skills
Professional AI-assisted security auditing toolkit with 24 skills for detecting, extracting, testing, and reporting Supabase vulnerabilities (RLS, IDOR, storage, auth, API).
Why this skill is useful
Adds a comprehensive suite of executable scripts for auditing Supabase applications, including vulnerability detection and reporting that are not commonly available in public documentation.
What it needs
Requires npx installed locally. About 10k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
Supabase Pentest Skills Skill by ara.so — Security Skills collection. A comprehensive toolkit of 24 AI agent skills for professional security auditing of Supabase applications. Automates detection, credential extraction, Row Level Security (RLS) testing, IDOR detection, storage audits, authentication analysis, and comprehensive reporting. What This Project Does Supabase Pentest Skills is a modular security auditing framework designed for internal self-assessment by authorized development teams. It provides: Detection: Identify Supabase usage from public URLs Extraction: Discover exposed API keys, JWTs, service keys, and database connection strings API Audit: Test PostgREST endpoints, RLS policies, and RPC functions Storage Audit: Identify misconfigured buckets and unauthorized file access Auth Audit: Test authentication flows, user enumeration, and IDOR vulnerabilities Evidence Collection: Professional-grade logging and proof-of-concept documentation Reporting: Generate detailed Markdown reports with severity ratings and remediation guidance Important: These skills are for authorized testing only. You must own or have explicit permission to audit the target application. Installation Quick Install (All 24 Skills) Install Specific Skill Packs List Available Skills Recommended Professional Setup For complete audit trail and evidence collection: Core Skills Reference Orchestration & Evidence Skill Purpose ------- --------- supabase-pentest Main orchestrator — guided step-by-step audit supabase-evidence Initialize professional evidence collection supabase-help Quick reference guide Detection & Extraction Skill Purpose ------- --------- supabase-detect Detect Supabase usage from HTML/JS supabase-extract-url Extract project URL supabase-extract-anon-key Extract anon/public API key supabase-extract-service-key Critical: Detect leaked servicerole key supabase-extract-jwt Extract and decode JWTs supabase-extract-db-string Detect exposed database connection strings API & RLS T …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/supabase-pentest-skills