Supabase / PostgREST Row-Level-Security playbook — pull the anon (or leaked service_role) key out of the frontend JS, map tables from the auto-generated OpenAPI spec, test anonymous RLS READ disclosures (PII/secret leaks), and anonymous RLS WRITE abuse (insert/update/delete — e.g. forging "certificate"/verification/entitlement rows the app trusts). Use when the target's frontend talks to *.supabase.co, ships an anon JWT, or you see /rest/v1/, /auth/v1/, /storage/v1/ requests.
$npx -y skills add pentesterflow/agent --skill supabaseInstalls into the current project.
Run `npx skills use "https://github.com/pentesterflow/agent" --skill "pentesterflow/agent/supabase"` and follow the generated skill instructions now. Read its complete output, redirecting it to a temporary file first if necessary. Resolve relative paths from the supporting-files directory it provides.
Use the skills in "https://github.com/pentesterflow/agent" that are relevant to the current task. Run `npx skills add "https://github.com/pentesterflow/agent"` and select the relevant skills, then follow their instructions.