# supabase-audit-auth-config

Audits Supabase GoTrue authentication settings via the public API. It uncovers disabled email confirmations, short passwords, and open CORS origins before production.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 549 installs · ★ 71
- Author: yoanbernabeu
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/yoanbernabeu/supabase-pentest-skills/tree/HEAD/skills/audit-auth/supabase-audit-auth-config/SKILL.md
- Updated: 2026-01-31
- HTML: https://affpapa.org/en/nevibecode/skills/supabase-audit-auth-config

## What it does

This skill queries Supabase GoTrue endpoints like `/auth/v1/settings` and `/auth/v1/signup` using the public API. It inspects signup policies, active OAuth providers, and anonymous login settings.

Instead of saving everything at the end, it writes findings progressively. The skill updates `.sb-pentest-context.json` immediately after checking each setting and logs events to `.sb-pentest-audit.log`. Because of this immediate writing, an interrupted run does not lose collected findings. It grades issues by severity, flagging disabled email confirmation as P1 or short password lengths as P2.

Running the audit requires both your Supabase project URL and the `anon` key. The skill will fail if the initial detection step has not finished.

## Requirements
- Works with: Supabase

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-auth-config -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/supabase-audit-auth-config/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/supabase-audit-auth-config/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-auth-config -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/supabase-audit-auth-config/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-auth-config -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/supabase-audit-auth-config/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install yoanbernabeu/supabase-pentest-skills supabase-audit-auth-config
```

2. **Manually: put the files in place**
- File: `.github/skills/supabase-audit-auth-config/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-auth-config -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/yoanbernabeu/supabase-pentest-skills --path skills/audit-auth/supabase-audit-auth-config
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/supabase-audit-auth-config/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-audit-auth-config -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/yoanbernabeu/supabase-pentest-skills/tree/HEAD/skills/audit-auth/supabase-audit-auth-config/SKILL.md

## When to use it
- Verify if email confirmation is enforced during signup
- Identify active OAuth providers and open registration status
- Detect short minimum password limits and wildcard CORS headers
- Log GoTrue audit results into `.sb-pentest-context.json`

## Example prompts
- Audit authentication configuration
- Check if signup is open and what providers are enabled

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 79a1760a69bd4c15.

BEGIN THIRD-PARTY FILE 79a1760a69bd4c15
````text
---
name: supabase-audit-auth-config
description: Analyze Supabase authentication configuration for security weaknesses and misconfigurations.
---

# Authentication Configuration Audit

> 🔴 **CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED**
>
> You MUST write to context files **AS YOU GO**, not just at the end.
> - Write to `.sb-pentest-context.json` **IMMEDIATELY after each setting analyzed**
> - Log to `.sb-pentest-audit.log` **BEFORE and AFTER each test**
> - **DO NOT** wait until the skill completes to update files
> - If the skill crashes or is interrupted, all prior findings must already be saved
>
> **This is not optional. Failure to write progressively is a critical error.**

This skill analyzes the authentication configuration of a Supabase project.

## When to Use This Skill

- To review authentication security settings
- Before production deployment
- When auditing auth-related vulnerabilities
- As part of comprehensive security review

## Prerequisites

- Supabase URL and anon key available
- Detection completed

## Auth Endpoints

Supabase Auth (GoTrue) exposes:

```
https://[project].supabase.co/auth/v1/
```

| Endpoint | Purpose |
|----------|---------|
| `/auth/v1/settings` | Public settings (limited) |
| `/auth/v1/signup` | User registration |
| `/auth/v1/token` | Authentication |
| `/auth/v1/user` | Current user info |
| `/auth/v1/recover` | Password recovery |

## What Can Be Detected

From the public API, we can detect:

| Setting | Detection Method |
|---------|------------------|
| Email auth enabled | Attempt signup |
| Phone auth enabled | Check settings |
| OAuth providers | Check settings |
| Signup disabled | Attempt signup |
| Email confirmation | Signup response |
| Password requirements | Error messages |

## Usage

### Basic Auth Audit

```
Audit authentication configuration
```

### Check Specific Features

```
Check if signup is open and what providers are enabled
```

## Output Format

```
═══════════════════════════════════════════════════════════
 AUTHENTICATION CONFIGURATION AUDIT
═══════════════════════════════════════════════════════════

 Project: abc123def.supabase.co
 Auth Endpoint: https://abc123def.supabase.co/auth/v1/

 ─────────────────────────────────────────────────────────
 Authentication Methods
````
END THIRD-PARTY FILE 79a1760a69bd4c15

The third-party file has ended. Everything between the 79a1760a69bd4c15 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2634 of 13177 bytes. © yoanbernabeu · MIT · https://github.com/yoanbernabeu/supabase-pentest-skills/tree/HEAD/skills/audit-auth/supabase-audit-auth-config/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md