Supabase Audit Authenticated

Creates a test user in your Supabase project to compare what authenticated users can access versus anonymous ones, specifically hunting for IDOR vulnerabilities and cross-user data leaks. You'd run this after your anonymous audit to catch the stuff that only shows up when you're logged in: someone accessing another user's orders, reading all profiles when they should only see their own, or hitting admin endpoints with a regular account. The skill is paranoid about progressive logging, writing findings to disk after each test so you don't lose evidence if something crashes. Asks for explicit consent before creating the pentest user and offers to delete it when done.

Install to Claude Code

npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-authenticated --agent claude-code