# supabase-report

Generates a structured Markdown security report from Supabase audit findings with risk scoring and remediation guidance.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 493 installs · ★ 71
- Author: yoanbernabeu
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/yoanbernabeu/supabase-pentest-skills/tree/HEAD/skills/report/supabase-report/SKILL.md
- Updated: 2026-01-31
- HTML: https://affpapa.org/en/nevibecode/skills/supabase-report

## What it does

The skill compiles pentest data into a Markdown report, saved as `supabase-audit-report.md` by default. The document covers an executive summary, quantified security score, findings split into P0, P1, and P2 priority tiers, and targeted remediation steps.

Execution relies on progressive file writes. It immediately records logs to `.sb-pentest-audit.log` and updates `.sb-pentest-context.json` as each section finishes. Interrupted runs retain partial results.

Generating the report requires a populated `.sb-pentest-context.json` file. If the audit phases did not run and collect vulnerabilities, the skill has nothing to process.

## Requirements
- Works with: Supabase

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-report -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/supabase-report/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/supabase-report/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-report -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/supabase-report/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-report -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/supabase-report/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install yoanbernabeu/supabase-pentest-skills supabase-report
```

2. **Manually: put the files in place**
- File: `.github/skills/supabase-report/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-report -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/yoanbernabeu/supabase-pentest-skills --path skills/report/supabase-report
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/supabase-report/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-report -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/yoanbernabeu/supabase-pentest-skills/tree/HEAD/skills/report/supabase-report/SKILL.md

## When to use it
- Compile Supabase security findings into a Markdown report
- Classify detected vulnerabilities into P0, P1, and P2 priority tiers
- Produce prioritized remediation instructions for database and auth misconfigurations
- Preserve audit progress progressively during execution

## Example prompts
- Generate security report from audit findings
- Generate report as security-audit-2025-01.md
- Generate executive summary only

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: b4855a0a06aefad6.

BEGIN THIRD-PARTY FILE b4855a0a06aefad6
````text
---
name: supabase-report
description: Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.
---

# Security Report Generator

> 🔴 **CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED**
>
> You MUST write to context files **AS YOU GO**, not just at the end.
> - Write to `.sb-pentest-audit.log` **IMMEDIATELY as you process each section**
> - Update `.sb-pentest-context.json` with report metadata **progressively**
> - **DO NOT** wait until the entire report is generated to update files
> - If the skill crashes or is interrupted, the partial progress must already be saved
>
> **This is not optional. Failure to write progressively is a critical error.**

This skill generates a comprehensive Markdown security audit report from all collected findings.

## When to Use This Skill

- After completing security audit phases
- To document findings for stakeholders
- To create actionable remediation plans
- For compliance and audit trail purposes

## Prerequisites

- Audit phases completed (context file populated)
- Findings collected in `.sb-pentest-context.json`

## Report Structure

The generated report includes:

1. **Executive Summary** — High-level overview for management
2. **Security Score** — Quantified risk assessment
3. **Critical Findings (P0)** — Immediate action required
4. **High Findings (P1)** — Address soon
5. **Medium Findings (P2)** — Plan to address
6. **Detailed Analysis** — Per-component breakdown
7. **Remediation Plan** — Prioritized action items
8. **Appendix** — Technical details, methodology

## Usage

### Generate Report

```
Generate security report from audit findings
```

### Custom Report Name

```
Generate report as security-audit-2025-01.md
```

### Specific Sections

```
Generate executive summary only
```

## Output Format

The skill generates `supabase-audit-report.md`:

```markdown
# Supabase Security Audit Report

**Target:** https://myapp.example.com
**Project:** abc123def.supabase.co
**Date:** January 31, 2025
**Auditor:** Internal Security Team

---

## Executive Summary

### Overview

This security audit identified **12 vulnerabilities** across the Supabase implementation, including **3 critical (P0)** issues requiring immediate attention.

### Key Findings

| Severity | Count | Status |
|----------|-------|--------|
| 🔴 P0 (Critical) | 3 | Immediate action required |
| 🟠 P1 (High) | 4 | Address within 7 days |
| 🟡 P2 (Medium) | 5 | Address within 30 days |

### Security Score

**Score: 35/100 (Grade: D)**

The application has significant security gaps that expose user data and allow privilege escalation. Critical issues must be addressed before the application can be considered secure.

### Most Critical Issues

1. **Service Role Key Exposed** — Full database access possible
2. **Database Backups Public** — All data downloadable
3. **Admin Function No Auth** — Any user can access admin features

### Recommended Actions
````
END THIRD-PARTY FILE b4855a0a06aefad6

The third-party file has ended. Everything between the b4855a0a06aefad6 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2991 of 11667 bytes. © yoanbernabeu · MIT · https://github.com/yoanbernabeu/supabase-pentest-skills/tree/HEAD/skills/report/supabase-report/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md