Supabase Pentest Skills

Skill by ara.so — Security Skills collection.

A comprehensive toolkit of 24 AI agent skills for professional security auditing of Supabase applications. Automates detection, credential extraction, Row Level Security (RLS) testing, IDOR detection, storage audits, authentication analysis, and comprehensive reporting.

What This Project Does

Supabase Pentest Skills is a modular security auditing framework designed for internal self-assessment by authorized development teams. It provides:

• Detection: Identify Supabase usage from public URLs
• Extraction: Discover exposed API keys, JWTs, service keys, and database connection strings
• API Audit: Test PostgREST endpoints, RLS policies, and RPC functions
• Storage Audit: Identify misconfigured buckets and unauthorized file access
• Auth Audit: Test authentication flows, user enumeration, and IDOR vulnerabilities
• Evidence Collection: Professional-grade logging and proof-of-concept documentation
• Reporting: Generate detailed Markdown reports with severity ratings and remediation guidance

Important: These skills are for authorized testing only. You must own or have explicit permission to audit the target application.