supabase-pentest by yoanbernabeu/supabase-pentest-skills
npx skills add https://github.com/yoanbernabeu/supabase-pentest-skills --skill supabase-pentest🔵 推荐:复杂审计请使用计划模式
当您的环境支持计划模式时,强烈建议在开始审计前激活它:
- 在编排开始时使用
EnterPlanMode工具- 计划模式能更好地组织多阶段审计
- 它允许用户在执行前验证方法
- 如果计划模式不可用,则直接执行
计划模式为审计过程提供了更好的可追溯性和用户控制。
🔴 关键要求:必须进行渐进式文件更新
您必须在审计过程中随时写入上下文文件,而不仅仅是在最后。
- 每次发现后立即写入
.sb-pentest-context.json- 每次操作前后记录到
.sb-pentest-audit.log- 切勿等到一个阶段或技能完成后再更新文件
- 如果审计崩溃或中断,所有先前的发现必须已经保存
这不是可选的。未能渐进式写入是一个严重错误。
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
此技能编排基于 Supabase 的应用程序的完整安全审计,通过验证检查点指导您完成每个阶段。
在开始任何审计之前,您必须:
.sb-pentest-context.json.sb-pentest-audit.log.sb-pentest-evidence/ 目录结构执行期间 - 随时写入:
.sb-pentest-audit.log.sb-pentest-context.json.sb-pentest-evidence/在整个审计过程中,必须系统地维护所有跟踪文件。
| 文件 | 用途 | 更新频率 |
|---|---|---|
.sb-pentest-context.json | 集中状态和发现 | 每次发现后 |
.sb-pentest-audit.log | 按时间顺序记录的操作日志 | 每次操作前后 |
.sb-pentest-evidence/timeline.md | 带时间戳的发现叙述 | 每次重要发现后 |
.sb-pentest-evidence/curl-commands.sh | 可复现的测试命令 | 每次 curl/HTTP 请求后 |
在进入下一阶段之前,编排器必须验证:
.sb-pentest-context.json 包含当前阶段的所有发现.sb-pentest-audit.log 记录了所有已执行的操作.sb-pentest-evidence/XX-phase-name/ 中timeline.md 已更新了任何 P0/P1/P2 发现curl-commands.sh 包含了所有发出的 HTTP 请求如果任何文件缺失或不完整,请勿进入下一阶段。
每个技能必须遵循此模式:
1. [日志] 将开始条目写入 audit.log
2. [上下文] 使用 "phase_in_progress" 更新 context.json
3. [操作] 执行测试/扫描
4. [证据] 立即保存证据文件
5. [CURL] 将 curl 命令追加到 curl-commands.sh
6. [时间线] 如果有重要发现,则更新 timeline.md
7. [上下文] 使用结果更新 context.json
8. [日志] 将完成条目写入 audit.log
如果技能或阶段失败:
⚠️ 为什么这很重要:
未能渐进式更新上下文文件是不可接受的。
每个单独的技能都有责任在工作过程中更新这些文件,而不仅仅是在完成时。如果某个技能没有渐进式更新上下文,编排器必须在每次发现后立即更新。
⚠️ 需要授权
在继续之前,您必须确认:
1. 我拥有此应用程序,或
2. 我有明确的书面授权来执行安全测试
未经授权的安全测试可能违反法律和服务条款。
输入 "I confirm I am authorized to test this application" 以继续。
编排器按顺序运行这些阶段,并在每个阶段之间进行确认。
📁 提醒:每次阶段后,请验证:
.sb-pentest-context.json已更新了阶段结果.sb-pentest-audit.log有开始和完成条目- 证据文件已保存到
.sb-pentest-evidence/XX-phase/timeline.md反映了任何重要发现curl-commands.sh包含了所有发出的 HTTP 请求
设置审计环境和证据收集。
阶段前操作(如果支持):
EnterPlanMode操作:
.sb-pentest-context.json.sb-pentest-audit.log.sb-pentest-evidence/ 目录结构curl-commands.shtimeline.md.sb-pentest-audit.log调用的技能:
supabase-evidence(初始化)继续前的验证:
输出: 准备好使用完整的目录结构收集证据
确定目标是否使用 Supabase 并提取基本信息。
调用的技能:
supabase-detect输出: 确认 Supabase 使用情况,识别项目 URL
证据保存到: .sb-pentest-evidence/01-detection/
扫描客户端代码以查找暴露的凭据。
调用的技能:
supabase-extract-urlsupabase-extract-anon-keysupabase-extract-service-keysupabase-extract-jwtsupabase-extract-db-string输出: 所有发现的凭据列表及严重性评估
证据保存到: .sb-pentest-evidence/02-extraction/
测试 PostgREST API 暴露情况和 RLS 策略。
调用的技能:
supabase-audit-tables-listsupabase-audit-tables-readsupabase-audit-rlssupabase-audit-rpc输出: 可访问的表、数据暴露评估、RLS 漏洞
证据保存到: .sb-pentest-evidence/03-api-audit/
检查存储桶配置和访问权限。
调用的技能:
supabase-audit-buckets-listsupabase-audit-buckets-readsupabase-audit-buckets-public输出: 存储桶清单、公共暴露情况、可访问的文件
证据保存到: .sb-pentest-evidence/04-storage-audit/
分析身份验证配置和潜在弱点。
调用的技能:
supabase-audit-auth-configsupabase-audit-auth-signupsupabase-audit-auth-userssupabase-audit-authenticated ← 新增:创建测试用户(经同意)以检测 IDOR输出: 身份验证提供者分析、注册限制、枚举风险、已验证与匿名用户对比
证据保存到: .sb-pentest-evidence/05-auth-audit/
⚠️ 注意:
supabase-audit-authenticated将在创建测试用户前请求明确同意。这是可选的,但强烈建议用于检测 IDOR 和跨用户访问漏洞。
测试 WebSocket 通道和 Edge Functions。
调用的技能:
supabase-audit-realtimesupabase-audit-functions输出: 暴露的通道、函数端点、访问控制问题
证据保存到: .sb-pentest-evidence/06-realtime-audit/ 和 .sb-pentest-evidence/07-functions-audit/
将所有发现编译成一份全面的报告。
调用的技能:
supabase-report输出: 包含执行摘要、发现和修复建议的完整 Markdown 报告
当支持计划模式时,推荐的工作流程是:
1. 用户请求审计 → 代理使用 EnterPlanMode
2. 代理初步探索目标(检测 Supabase,提取 URL)
3. 代理将计划写入计划文件,包含:
- 目标 URL
- 检测到的 Supabase 配置
- 建议执行的阶段
- 估计范围
4. 代理使用 ExitPlanMode → 用户审查并批准
5. 代理执行阶段并系统更新文件
6. 每个阶段后 → 代理确认文件已更新
7. 最终报告生成
计划模式的优点:
在 https://myapp.example.com 上运行 Supabase 安全审计
代理应该:
EnterPlanMode在 https://myapp.example.com 上运行 Supabase 安全审计 --no-plan
从阶段 3(API 审计)继续 Supabase 审计
在 https://myapp.example.com 上运行 Supabase 审计,跳过身份验证审计
⚠️ 关键:更新跟踪文件和收集证据是强制性的。
编排器创建并管理:
| 文件/目录 | 用途 |
|---|---|
.sb-pentest-context.json | 在阶段之间存储提取的数据 |
.sb-pentest-audit.log | 记录所有带时间戳的操作 |
.sb-pentest-evidence/ | 专业审计的证据目录 |
编排器在每次审计开始时初始化证据目录:
.sb-pentest-evidence/
├── README.md # 证据索引
├── curl-commands.sh # 所有可复现的 curl 命令
├── timeline.md # 按时间顺序的发现
├── 01-detection/ # 检测证据
├── 02-extraction/ # 密钥提取证据
├── 03-api-audit/ # API 审计证据
│ ├── tables/
│ ├── data-samples/
│ ├── rls-tests/
│ └── rpc-tests/
├── 04-storage-audit/ # 存储审计证据
│ ├── buckets/
│ └── public-url-tests/
├── 05-auth-audit/ # 身份验证审计证据
│ ├── signup-tests/
│ └── enumeration-tests/
├── 06-realtime-audit/ # 实时审计证据
├── 07-functions-audit/ # 函数审计证据
└── screenshots/ # 可选截图
每个技能必须在其工作过程中将证据保存到相应的目录。
.sb-pentest-context.json 必须用结果更新.sb-pentest-audit.log 中.sb-pentest-audit.log 中的每个条目必须遵循此格式:
[YYYY-MM-DD HH:MM:SS] [SKILL_NAME] [STATUS] Message
示例:
[2025-01-31 14:00:00] [supabase-detect] [START] Starting Supabase detection
[2025-01-31 14:00:05] [supabase-detect] [SUCCESS] Supabase detected
[2025-01-31 14:00:05] [supabase-detect] [CONTEXT_UPDATED] .sb-pentest-context.json updated
{
"target_url": "https://myapp.example.com",
"started_at": "2025-01-31T10:00:00Z",
"authorization_confirmed": true,
"supabase": {
"detected": true,
"project_url": "https://abc123.supabase.co",
"anon_key": "eyJ...",
"service_key_exposed": false
},
"phases_completed": ["detection", "extraction"],
"findings": []
}
编排器实现自适应速率限制:
每个阶段后:
═══════════════════════════════════════════════════════════
阶段 2 完成:密钥提取
═══════════════════════════════════════════════════════════
发现:
├── ✅ 找到匿名密钥(预期)
├── ❌ P0:服务角色密钥在 main.js:1247 处暴露
└── ⚠️ P1:检测到 JWT 密钥模式
继续阶段 3(API 审计)?[Y/n]
═══════════════════════════════════════════════════════════
❌ 问题: 审计在阶段 1 停止,显示“未检测到 Supabase” ✅ 解决方案: 应用程序可能使用自定义域。手动提供 Supabase URL:
使用 Supabase URL https://myproject.supabase.co 运行审计
❌ 问题: 审计期间被速率限制 ✅ 解决方案: 编排器会自动调整。如果持续存在,请等待 5 分钟并恢复。
❌ 问题: 上下文文件损坏 ✅ 解决方案: 删除 .sb-pentest-context.json 并重新启动审计。
supabase-help — 所有技能的快速参考supabase-evidence — 证据收集管理supabase-report — 从现有上下文生成报告supabase-report-compare — 与之前的审计进行比较每周安装次数
132
代码仓库
GitHub 星标数
32
首次出现
Jan 31, 2026
安全审计
安装于
codex98
opencode97
claude-code94
gemini-cli93
github-copilot87
cursor82
🔵 RECOMMENDED: USE PLAN MODE FOR COMPLEX AUDITS
When your environment supports Plan Mode , it is strongly recommended to activate it before starting the audit:
- Use the
EnterPlanModetool at the start of the orchestration- Plan Mode enables better organization of multi-phase audits
- It allows the user to validate the approach before execution
- If Plan Mode is not available, proceed directly with execution
Plan Mode provides better traceability and user control over the audit process.
🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED
You MUST write to context files AS YOU GO , not just at the end.
- Write to
.sb-pentest-context.jsonIMMEDIATELY after each discovery- Log to
.sb-pentest-audit.logBEFORE and AFTER each action- DO NOT wait until a phase or skill completes to update files
- If the audit crashes or is interrupted, all prior findings must already be saved
This is not optional. Failure to write progressively is a critical error.
This skill orchestrates a complete security audit of a Supabase-based application, guiding you through each phase with validation checkpoints.
BEFORE starting any audit, you MUST:
.sb-pentest-context.json if it doesn't exist.sb-pentest-audit.log if it doesn't exist.sb-pentest-evidence/ directory structureDURING execution - WRITE AS YOU GO:
.sb-pentest-audit.log.sb-pentest-context.json.sb-pentest-evidence/All tracking files MUST be systematically maintained throughout the entire audit.
| File | Purpose | Update Frequency |
|---|---|---|
.sb-pentest-context.json | Centralized state and findings | After EVERY discovery |
.sb-pentest-audit.log | Chronological action log | BEFORE and AFTER every action |
.sb-pentest-evidence/timeline.md | Timestamped findings narrative | After EVERY significant finding |
.sb-pentest-evidence/curl-commands.sh | Reproducible test commands | After EVERY curl/HTTP request |
Before moving to the next phase, the orchestrator MUST verify:
.sb-pentest-context.json contains all discoveries from current phase.sb-pentest-audit.log has entries for all actions performed.sb-pentest-evidence/XX-phase-name/timeline.md is updated with any P0/P1/P2 findingscurl-commands.sh contains all HTTP requests madeIf any file is missing or incomplete, DO NOT proceed to the next phase.
Each skill MUST follow this pattern:
1. [LOG] Write START entry to audit.log
2. [CONTEXT] Update context.json with "phase_in_progress"
3. [ACTION] Perform the test/scan
4. [EVIDENCE] Save evidence file IMMEDIATELY
5. [CURL] Append curl command to curl-commands.sh
6. [TIMELINE] Update timeline.md if significant finding
7. [CONTEXT] Update context.json with results
8. [LOG] Write COMPLETE entry to audit.log
If a skill or phase fails:
⚠️ WHY THIS MATTERS:
FAILURE TO UPDATE CONTEXT FILES PROGRESSIVELY IS NOT ACCEPTABLE.
Each individual skill is responsible for updating these files AS IT WORKS , not just at completion. If a skill does not update the context progressively, the orchestrator must do it immediately after each discovery.
⚠️ AUTHORIZATION REQUIRED
Before proceeding, you must confirm:
1. I own this application, OR
2. I have explicit written authorization to perform security testing
Unauthorized security testing may violate laws and terms of service.
Type "I confirm I am authorized to test this application" to proceed.
The orchestrator runs these phases sequentially with confirmation between each.
📁 REMINDER: After EVERY phase, verify that:
.sb-pentest-context.jsonis updated with phase results.sb-pentest-audit.loghas START and COMPLETE entries- Evidence files are saved to
.sb-pentest-evidence/XX-phase/timeline.mdreflects any significant findingscurl-commands.shcontains all HTTP requests made
Sets up the audit environment and evidence collection.
Pre-Phase Action (if supported):
EnterPlanMode if the environment supports itActions:
.sb-pentest-context.json.sb-pentest-audit.log.sb-pentest-evidence/ directory structurecurl-commands.sh with headertimeline.md with audit start.sb-pentest-audit.logSkills invoked:
supabase-evidence (initialization)Verification before proceeding:
Output: Ready to collect evidence with full directory structure
Determines if the target uses Supabase and extracts basic information.
Skills invoked:
supabase-detectOutput: Confirmation of Supabase usage, project URL identified
Evidence saved to: .sb-pentest-evidence/01-detection/
Scans client-side code for exposed credentials.
Skills invoked:
supabase-extract-urlsupabase-extract-anon-keysupabase-extract-service-keysupabase-extract-jwtsupabase-extract-db-stringOutput: List of all discovered credentials with severity assessment
Evidence saved to: .sb-pentest-evidence/02-extraction/
Tests PostgREST API exposure and RLS policies.
Skills invoked:
supabase-audit-tables-listsupabase-audit-tables-readsupabase-audit-rlssupabase-audit-rpcOutput: Tables accessible, data exposure assessment, RLS gaps
Evidence saved to: .sb-pentest-evidence/03-api-audit/
Checks storage bucket configurations and access.
Skills invoked:
supabase-audit-buckets-listsupabase-audit-buckets-readsupabase-audit-buckets-publicOutput: Bucket inventory, public exposure, accessible files
Evidence saved to: .sb-pentest-evidence/04-storage-audit/
Analyzes authentication configuration and potential weaknesses.
Skills invoked:
supabase-audit-auth-configsupabase-audit-auth-signupsupabase-audit-auth-userssupabase-audit-authenticated ← NEW: Creates test user (with consent) to detect IDOROutput: Auth provider analysis, signup restrictions, enumeration risks, authenticated vs anonymous comparison
Evidence saved to: .sb-pentest-evidence/05-auth-audit/
⚠️ Note:
supabase-audit-authenticatedwill ask for explicit consent before creating a test user. This is optional but highly recommended to detect IDOR and cross-user access vulnerabilities.
Tests WebSocket channels and Edge Functions.
Skills invoked:
supabase-audit-realtimesupabase-audit-functionsOutput: Exposed channels, function endpoints, access control issues
Evidence saved to: .sb-pentest-evidence/06-realtime-audit/ and .sb-pentest-evidence/07-functions-audit/
Compiles all findings into a comprehensive report.
Skills invoked:
supabase-reportOutput: Full Markdown report with executive summary, findings, and remediation
When Plan Mode is supported, the recommended workflow is:
1. User requests audit → Agent uses EnterPlanMode
2. Agent explores target superficially (detect Supabase, extract URL)
3. Agent writes plan to plan file with:
- Target URL
- Detected Supabase configuration
- Proposed phases to execute
- Estimated scope
4. Agent uses ExitPlanMode → User reviews and approves
5. Agent executes phases with systematic file updates
6. After each phase → Agent confirms files are updated
7. Final report generation
Benefits of Plan Mode:
Run a Supabase security audit on https://myapp.example.com
The agent SHOULD:
EnterPlanMode if availableRun a Supabase security audit on https://myapp.example.com --no-plan
Continue Supabase audit from Phase 3 (API Audit)
Run Supabase audit on https://myapp.example.com, skip auth audit
⚠️ CRITICAL: Updating tracking files and collecting evidence is MANDATORY.
The orchestrator creates and manages:
| File/Directory | Purpose |
|---|---|
.sb-pentest-context.json | Stores extracted data between phases |
.sb-pentest-audit.log | Logs all actions with timestamps |
.sb-pentest-evidence/ | Evidence directory for professional audits |
The orchestrator initializes the evidence directory at the start of every audit:
.sb-pentest-evidence/
├── README.md # Evidence index
├── curl-commands.sh # All reproducible curl commands
├── timeline.md # Chronological findings
├── 01-detection/ # Detection evidence
├── 02-extraction/ # Key extraction evidence
├── 03-api-audit/ # API audit evidence
│ ├── tables/
│ ├── data-samples/
│ ├── rls-tests/
│ └── rpc-tests/
├── 04-storage-audit/ # Storage audit evidence
│ ├── buckets/
│ └── public-url-tests/
├── 05-auth-audit/ # Auth audit evidence
│ ├── signup-tests/
│ └── enumeration-tests/
├── 06-realtime-audit/ # Realtime audit evidence
├── 07-functions-audit/ # Functions audit evidence
└── screenshots/ # Optional screenshots
Each skill MUST save evidence to its respective directory as it works.
.sb-pentest-context.json MUST be updated with results.sb-pentest-audit.log with timestampEach entry in .sb-pentest-audit.log must follow this format:
[YYYY-MM-DD HH:MM:SS] [SKILL_NAME] [STATUS] Message
Example:
[2025-01-31 14:00:00] [supabase-detect] [START] Starting Supabase detection
[2025-01-31 14:00:05] [supabase-detect] [SUCCESS] Supabase detected
[2025-01-31 14:00:05] [supabase-detect] [CONTEXT_UPDATED] .sb-pentest-context.json updated
{
"target_url": "https://myapp.example.com",
"started_at": "2025-01-31T10:00:00Z",
"authorization_confirmed": true,
"supabase": {
"detected": true,
"project_url": "https://abc123.supabase.co",
"anon_key": "eyJ...",
"service_key_exposed": false
},
"phases_completed": ["detection", "extraction"],
"findings": []
}
The orchestrator implements adaptive rate limiting:
After each phase:
═══════════════════════════════════════════════════════════
PHASE 2 COMPLETE: Key Extraction
═══════════════════════════════════════════════════════════
Findings:
├── ✅ Anon key found (expected)
├── ❌ P0: Service role key EXPOSED in main.js:1247
└── ⚠️ P1: JWT secret pattern detected
Proceed to Phase 3 (API Audit)? [Y/n]
═══════════════════════════════════════════════════════════
❌ Problem: Audit stops at Phase 1 with "Supabase not detected" ✅ Solution: The app may use a custom domain. Manually provide the Supabase URL:
Run audit with Supabase URL https://myproject.supabase.co
❌ Problem: Rate limited during audit ✅ Solution: The orchestrator auto-adjusts. If persistent, wait 5 minutes and resume.
❌ Problem: Context file corrupted ✅ Solution: Delete .sb-pentest-context.json and restart the audit.
supabase-help — Quick reference for all skillssupabase-evidence — Evidence collection managementsupabase-report — Generate report from existing contextsupabase-report-compare — Compare with previous auditsWeekly Installs
132
Repository
GitHub Stars
32
First Seen
Jan 31, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykFail
Installed on
codex98
opencode97
claude-code94
gemini-cli93
github-copilot87
cursor82
OpenClaw 安全 Linux 云部署指南:私有优先、SSH隧道、Podman容器化
36,400 周安装