supabase-extract-service-key by yoanbernabeu/supabase-pentest-skills
npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-extract-service-key🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED
您必须在操作过程中逐步写入上下文文件,而不是仅在最后才写入。
- 每次发现后立即写入
.sb-pentest-context.json- 每次操作前后记录到
.sb-pentest-audit.log- 请勿等到技能完成才更新文件
- 如果技能崩溃或中断,所有先前的发现必须已经保存
这不是可选的。未能逐步写入是严重错误。
此技能用于检测 service_role 密钥(管理员密钥)是否意外暴露在客户端代码中。
service_role 密钥会绕过所有行级安全策略。如果暴露:
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| 影响 | 描述 |
|---|---|
| 🔴 完全数据库访问 | 读取/写入/删除所有表中的所有数据 |
| 🔴 身份验证绕过 | 无需身份验证即可访问所有用户数据 |
| 🔴 存储访问 | 读取/写入所有存储桶中的所有文件 |
| 🔴 用户模拟 | 为任何用户生成令牌 |
这是一个 P0(严重)发现,需要立即采取行动。
| 方面 | 匿名密钥 | 服务密钥 |
|---|---|---|
| 角色声明 | "role": "anon" | "role": "service_role" |
| RLS | ✅ 遵守 RLS | ❌ 绕过 RLS |
| 客户端 | ✅ 预期 | ❌ 绝对禁止 |
| 服务器端 | ✅ 可以使用 | ✅ 应该使用 |
此技能搜索:
// 解码后的 JWT 负载包含:
{
"role": "service_role", // ❌ 如果在客户端代码中则为严重问题
"iss": "supabase",
"ref": "abc123def"
}
// 常见的命名模式
SUPABASE_SERVICE_KEY
SUPABASE_SERVICE_ROLE_KEY
SUPABASE_ADMIN_KEY
SUPABASE_SECRET_KEY
SERVICE_ROLE_KEY
// 有时与匿名密钥一起暴露
const keys = {
anon: 'eyJ...',
service: 'eyJ...' // ❌ 不应该在这里
}
Check for service key leak on https://myapp.example.com
Deep scan for service key exposure on https://myapp.example.com
═══════════════════════════════════════════════════════════
SERVICE KEY CHECK
═══════════════════════════════════════════════════════════
状态:✅ 未在客户端代码中检测到 service_role 密钥
已扫描:
├── HTML 源代码:干净
├── JavaScript 包:5 个文件,已分析 2.3MB
├── 内联脚本:检查了 12 个块
└── 源映射:未暴露(良好)
JWT 分析:
└── 找到 1 个密钥,确认角色为 anon(安全)
结果:通过 - 未发现关键密钥暴露
═══════════════════════════════════════════════════════════
═══════════════════════════════════════════════════════════
🔴 严重:服务密钥已暴露
═══════════════════════════════════════════════════════════
严重性:P0 - 严重
状态:❌ 在客户端代码中发现 service_role 密钥!
⚠️ 需要立即采取行动 ⚠️
暴露的密钥:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBh
YmFzZSIsInJlZiI6ImFiYzEyM2RlZiIsInJvbGUiOiJzZXJ2aWNlX3
JvbGUiLCJpYXQiOjE2NDAwMDAwMDAsImV4cCI6MTk1NTM2MDAwMH0
.xxxxxxxxxxxxx
位置:
└── /static/js/admin.chunk.js (第 89 行)
const SUPABASE_KEY = 'eyJhbG...' // 在 createClient() 中使用
解码后的负载:
├── role: service_role ← 严重
├── ref: abc123def
└── exp: 2031-12-20
影响评估:
├── 🔴 可能完全访问数据库
├── 🔴 所有 RLS 策略被绕过
├── 🔴 所有用户数据暴露
└── 🔴 所有存储桶可访问
═══════════════════════════════════════════════════════════
立即修复步骤
═══════════════════════════════════════════════════════════
1. 立即轮换密钥
→ Supabase 仪表板 > 设置 > API > 重新生成 service_role 密钥
2. 从客户端代码中移除
→ 从源代码中删除密钥
→ 重新部署应用程序
3. 审计滥用情况
→ 检查 Supabase 日志中是否有未经授权的访问
→ 审查数据库是否有意外更改
4. 使用边缘函数
→ 将特权操作移至边缘函数
→ 客户端调用边缘函数,后者在服务器端使用服务密钥
文档:
→ https://supabase.com/docs/guides/api/api-keys
→ https://supabase.com/docs/guides/functions
═══════════════════════════════════════════════════════════
保存到 .sb-pentest-context.json:
{
"findings": [
{
"id": "SERVICE_KEY_EXPOSED",
"severity": "P0",
"title": "Service Role Key Exposed in Client Code",
"description": "The service_role key was found in client-side JavaScript",
"location": {
"file": "/static/js/admin.chunk.js",
"line": 89
},
"evidence": {
"key_prefix": "eyJhbGciOiJIUzI1NiI...",
"role": "service_role",
"project_ref": "abc123def"
},
"remediation": {
"immediate": "Rotate key in Supabase Dashboard",
"long_term": "Move to Edge Functions",
"docs": "https://supabase.com/docs/guides/api/api-keys"
}
}
],
"supabase": {
"service_key_exposed": true,
"service_key_location": "/static/js/admin.chunk.js:89"
}
}
此技能还会检查可能暴露密钥的源映射:
Source Maps Analysis:
├── main.js.map: ❌ Exposed (may contain secrets)
├── vendor.js.map: ❌ Exposed
└── Recommendation: Disable source maps in production
To check source maps content:
→ Add .map to JS URLs: /static/js/main.js.map
| 原因 | 解决方案 |
|---|---|
| 错误的环境变量 | 仅对匿名密钥使用 NEXT_PUBLIC_ |
| 复制粘贴错误 | 仔细检查您使用的是哪个密钥 |
| 调试代码遗留 | 在生产构建前移除 |
| 打包器配置错误 | 确保服务密钥环境变量未包含在内 |
// ❌ 错误 - 服务密钥在客户端
import { createClient } from '@supabase/supabase-js'
const supabase = createClient(
process.env.NEXT_PUBLIC_SUPABASE_URL,
process.env.NEXT_PUBLIC_SUPABASE_SERVICE_KEY // ❌ 绝对不要这样做
)
// ✅ 正确 - 客户端仅使用匿名密钥
import { createClient } from '@supabase/supabase-js'
const supabase = createClient(
process.env.NEXT_PUBLIC_SUPABASE_URL,
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY // ✅ 客户端安全
)
// 对于特权操作,调用边缘函数:
const { data } = await supabase.functions.invoke('admin-action', {
body: { action: 'delete-user', userId: '123' }
})
// supabase/functions/admin-action/index.ts
import { createClient } from '@supabase/supabase-js'
Deno.serve(async (req) => {
// ✅ 服务密钥仅在服务器上
const supabase = createClient(
Deno.env.get('SUPABASE_URL'),
Deno.env.get('SUPABASE_SERVICE_ROLE_KEY') // ✅ 服务器端安全
)
// 执行特权操作
// ...
})
⚠️ 此技能必须在执行过程中逐步更新跟踪文件,而不仅仅是在最后。
请勿在最后批量写入所有内容。而是:
.sb-pentest-audit.log.sb-pentest-context.json.sb-pentest-audit.log这确保了如果技能被中断、崩溃或超时,所有到该点为止的发现都能被保留。
更新 .sb-pentest-context.json 并包含发现:
{ "supabase": { "service_key_exposed": true/false, "service_key_location": "path:line" }, "findings": [ { "id": "SERVICE_KEY_EXPOSED", "severity": "P0", "title": "Service Role Key Exposed", ... } ] }
记录到 .sb-pentest-audit.log:
[TIMESTAMP] [supabase-extract-service-key] [START] Checking for service key exposure [TIMESTAMP] [supabase-extract-service-key] [CRITICAL] Service key EXPOSED at path:line [TIMESTAMP] [supabase-extract-service-key] [CONTEXT_UPDATED] .sb-pentest-context.json updated
如果文件不存在,在写入前创建它们。
未能更新上下文文件是不可接受的。
📁 证据目录: .sb-pentest-evidence/02-extraction/service-key-exposure/
| 文件 | 内容 |
|---|---|
service-key-exposure/location.txt | 文件路径和行号 |
service-key-exposure/decoded-payload.json | 解码后的 JWT,证明是 service_role |
service-key-exposure/code-snippet.txt | 代码上下文(已脱敏) |
{
"evidence_id": "EXT-SVC-001",
"timestamp": "2025-01-31T10:10:00Z",
"category": "extraction",
"type": "service_key_exposure",
"severity": "P0",
"finding_id": "P0-001",
"key_data": {
"key_prefix": "eyJhbGciOiJIUzI1NiI...",
"key_suffix": "...xxxx",
"role": "service_role"
},
"decoded_payload": {
"iss": "supabase",
"ref": "abc123def",
"role": "service_role",
"iat": "2021-12-20T00:00:00Z",
"exp": "2031-12-20T00:00:00Z"
},
"location": {
"file": "/static/js/admin.chunk.js",
"line": 89,
"context": "const SUPABASE_KEY = 'eyJhbG...' // [REDACTED]"
},
"impact": {
"rls_bypass": true,
"full_db_access": true,
"auth_users_access": true,
"storage_access": true
},
"curl_command": "curl -X GET 'https://abc123def.supabase.co/rest/v1/users' -H 'apikey: [SERVICE_KEY]' -H 'Authorization: Bearer [SERVICE_KEY]'"
}
## [TIMESTAMP] - 🔴 P0 严重:服务角色密钥暴露
- 在客户端代码中发现服务角色密钥
- 位置:[file]:[line]
- 影响:完全数据库访问,RLS 绕过
- 证据:`02-extraction/service-key-exposure/`
- **需要立即采取行动**
supabase-extract-anon-key — 提取(预期的)匿名密钥supabase-audit-tables-read — 测试可访问哪些数据supabase-report — 生成包含此发现的完整报告每周安装
87
仓库
GitHub 星标
33
首次出现
Jan 31, 2026
安全审计
安装于
claude-code72
codex63
opencode61
gemini-cli58
github-copilot53
cursor53
🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED
You MUST write to context files AS YOU GO , not just at the end.
- Write to
.sb-pentest-context.jsonIMMEDIATELY after each discovery- Log to
.sb-pentest-audit.logBEFORE and AFTER each action- DO NOT wait until the skill completes to update files
- If the skill crashes or is interrupted, all prior findings must already be saved
This is not optional. Failure to write progressively is a critical error.
This skill detects if the service_role key (admin key) is accidentally exposed in client-side code.
The service_role key bypasses ALL Row Level Security (RLS) policies. If exposed:
| Impact | Description |
|---|---|
| 🔴 Full DB Access | Read/write/delete all data in all tables |
| 🔴 Auth Bypass | Access all user data without authentication |
| 🔴 Storage Access | Read/write all files in all buckets |
| 🔴 User Impersonation | Generate tokens for any user |
This is a P0 (Critical) finding that requires immediate action.
| Aspect | Anon Key | Service Key |
|---|---|---|
| Role claim | "role": "anon" | "role": "service_role" |
| RLS | ✅ Respects RLS | ❌ Bypasses RLS |
| Client-side | ✅ Expected | ❌ NEVER |
| Server-side | ✅ Can use | ✅ Should use |
The skill searches for:
// Decoded JWT payload contains:
{
"role": "service_role", // ❌ CRITICAL if in client code
"iss": "supabase",
"ref": "abc123def"
}
// Common naming patterns
SUPABASE_SERVICE_KEY
SUPABASE_SERVICE_ROLE_KEY
SUPABASE_ADMIN_KEY
SUPABASE_SECRET_KEY
SERVICE_ROLE_KEY
// Sometimes exposed alongside anon key
const keys = {
anon: 'eyJ...',
service: 'eyJ...' // ❌ Should not be here
}
Check for service key leak on https://myapp.example.com
Deep scan for service key exposure on https://myapp.example.com
═══════════════════════════════════════════════════════════
SERVICE KEY CHECK
═══════════════════════════════════════════════════════════
Status: ✅ No service_role key detected in client code
Scanned:
├── HTML source: Clean
├── JavaScript bundles: 5 files, 2.3MB analyzed
├── Inline scripts: 12 blocks checked
└── Source maps: Not exposed (good)
JWT Analysis:
└── 1 key found, confirmed role=anon (safe)
Result: PASS - No critical key exposure
═══════════════════════════════════════════════════════════
═══════════════════════════════════════════════════════════
🔴 CRITICAL: SERVICE KEY EXPOSED
═══════════════════════════════════════════════════════════
Severity: P0 - CRITICAL
Status: ❌ service_role key found in client-side code!
⚠️ IMMEDIATE ACTION REQUIRED ⚠️
Exposed Key:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBh
YmFzZSIsInJlZiI6ImFiYzEyM2RlZiIsInJvbGUiOiJzZXJ2aWNlX3
JvbGUiLCJpYXQiOjE2NDAwMDAwMDAsImV4cCI6MTk1NTM2MDAwMH0
.xxxxxxxxxxxxx
Location:
└── /static/js/admin.chunk.js (line 89)
const SUPABASE_KEY = 'eyJhbG...' // Used in createClient()
Decoded Payload:
├── role: service_role ← CRITICAL
├── ref: abc123def
└── exp: 2031-12-20
Impact Assessment:
├── 🔴 Full database access possible
├── 🔴 All RLS policies bypassed
├── 🔴 All user data exposed
└── 🔴 All storage buckets accessible
═══════════════════════════════════════════════════════════
IMMEDIATE REMEDIATION STEPS
═══════════════════════════════════════════════════════════
1. ROTATE THE KEY NOW
→ Supabase Dashboard > Settings > API > Regenerate service_role key
2. REMOVE FROM CLIENT CODE
→ Delete the key from your source code
→ Redeploy your application
3. AUDIT FOR ABUSE
→ Check Supabase logs for unauthorized access
→ Review database for unexpected changes
4. USE EDGE FUNCTIONS
→ Move privileged operations to Edge Functions
→ Client calls Edge Function, which uses service key server-side
Documentation:
→ https://supabase.com/docs/guides/api/api-keys
→ https://supabase.com/docs/guides/functions
═══════════════════════════════════════════════════════════
Saved to .sb-pentest-context.json:
{
"findings": [
{
"id": "SERVICE_KEY_EXPOSED",
"severity": "P0",
"title": "Service Role Key Exposed in Client Code",
"description": "The service_role key was found in client-side JavaScript",
"location": {
"file": "/static/js/admin.chunk.js",
"line": 89
},
"evidence": {
"key_prefix": "eyJhbGciOiJIUzI1NiI...",
"role": "service_role",
"project_ref": "abc123def"
},
"remediation": {
"immediate": "Rotate key in Supabase Dashboard",
"long_term": "Move to Edge Functions",
"docs": "https://supabase.com/docs/guides/api/api-keys"
}
}
],
"supabase": {
"service_key_exposed": true,
"service_key_location": "/static/js/admin.chunk.js:89"
}
}
The skill also checks for exposed source maps that might reveal keys:
Source Maps Analysis:
├── main.js.map: ❌ Exposed (may contain secrets)
├── vendor.js.map: ❌ Exposed
└── Recommendation: Disable source maps in production
To check source maps content:
→ Add .map to JS URLs: /static/js/main.js.map
| Cause | Solution |
|---|---|
| Wrong env variable | Use NEXT_PUBLIC_ only for anon key |
| Copy-paste error | Double-check which key you're using |
| Debug code left in | Remove before production build |
| Misconfigured bundler | Ensure service key env vars are not included |
// ❌ WRONG - Service key in client
import { createClient } from '@supabase/supabase-js'
const supabase = createClient(
process.env.NEXT_PUBLIC_SUPABASE_URL,
process.env.NEXT_PUBLIC_SUPABASE_SERVICE_KEY // ❌ NEVER DO THIS
)
// ✅ CORRECT - Only anon key in client
import { createClient } from '@supabase/supabase-js'
const supabase = createClient(
process.env.NEXT_PUBLIC_SUPABASE_URL,
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY // ✅ Safe for client
)
// For privileged operations, call an Edge Function:
const { data } = await supabase.functions.invoke('admin-action', {
body: { action: 'delete-user', userId: '123' }
})
// supabase/functions/admin-action/index.ts
import { createClient } from '@supabase/supabase-js'
Deno.serve(async (req) => {
// ✅ Service key only on server
const supabase = createClient(
Deno.env.get('SUPABASE_URL'),
Deno.env.get('SUPABASE_SERVICE_ROLE_KEY') // ✅ Safe on server
)
// Perform privileged operation
// ...
})
⚠️ This skill MUST update tracking files PROGRESSIVELY during execution, NOT just at the end.
DO NOT batch all writes at the end. Instead:
.sb-pentest-audit.log.sb-pentest-context.json.sb-pentest-audit.logThis ensures that if the skill is interrupted, crashes, or times out, all findings up to that point are preserved.
Update.sb-pentest-context.json with findings:
{ "supabase": { "service_key_exposed": true/false, "service_key_location": "path:line" }, "findings": [ { "id": "SERVICE_KEY_EXPOSED", "severity": "P0", "title": "Service Role Key Exposed", ... } ] }
Log to.sb-pentest-audit.log:
[TIMESTAMP] [supabase-extract-service-key] [START] Checking for service key exposure [TIMESTAMP] [supabase-extract-service-key] [CRITICAL] Service key EXPOSED at path:line [TIMESTAMP] [supabase-extract-service-key] [CONTEXT_UPDATED] .sb-pentest-context.json updated
If files don't exist , create them before writing.
FAILURE TO UPDATE CONTEXT FILES IS NOT ACCEPTABLE.
📁 Evidence Directory: .sb-pentest-evidence/02-extraction/service-key-exposure/
| File | Content |
|---|---|
service-key-exposure/location.txt | File path and line number |
service-key-exposure/decoded-payload.json | Decoded JWT proving it's service_role |
service-key-exposure/code-snippet.txt | Code context (redacted) |
{
"evidence_id": "EXT-SVC-001",
"timestamp": "2025-01-31T10:10:00Z",
"category": "extraction",
"type": "service_key_exposure",
"severity": "P0",
"finding_id": "P0-001",
"key_data": {
"key_prefix": "eyJhbGciOiJIUzI1NiI...",
"key_suffix": "...xxxx",
"role": "service_role"
},
"decoded_payload": {
"iss": "supabase",
"ref": "abc123def",
"role": "service_role",
"iat": "2021-12-20T00:00:00Z",
"exp": "2031-12-20T00:00:00Z"
},
"location": {
"file": "/static/js/admin.chunk.js",
"line": 89,
"context": "const SUPABASE_KEY = 'eyJhbG...' // [REDACTED]"
},
"impact": {
"rls_bypass": true,
"full_db_access": true,
"auth_users_access": true,
"storage_access": true
},
"curl_command": "curl -X GET 'https://abc123def.supabase.co/rest/v1/users' -H 'apikey: [SERVICE_KEY]' -H 'Authorization: Bearer [SERVICE_KEY]'"
}
## [TIMESTAMP] - 🔴 P0 CRITICAL: Service Role Key Exposed
- Service role key found in client-side code
- Location: [file]:[line]
- Impact: Full database access, RLS bypass
- Evidence: `02-extraction/service-key-exposure/`
- **IMMEDIATE ACTION REQUIRED**
supabase-extract-anon-key — Extract the (expected) anon keysupabase-audit-tables-read — Test what data is accessiblesupabase-report — Generate full report including this findingWeekly Installs
87
Repository
GitHub Stars
33
First Seen
Jan 31, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykFail
Installed on
claude-code72
codex63
opencode61
gemini-cli58
github-copilot53
cursor53
Azure 升级评估与自动化工具 - 轻松迁移 Functions 计划、托管层级和 SKU
104,900 周安装