Loading...
Loading...
Found 54 Skills
Extract the Supabase project URL from client-side JavaScript code, environment variables, and configuration files.
Create a test user (with explicit permission) to audit what authenticated users can access vs anonymous users. Detects IDOR, cross-user access, and privilege escalation.
CRITICAL - Detect if the Supabase service_role key is leaked in client-side code. This is a P0 severity issue.
Attempt to list and read files from storage buckets to verify access controls.
Extract and decode Supabase-related JWTs from client-side code, cookies, and local storage patterns.
Set up HelpMeTest proxy tunnels for local development testing. Use when user needs to test localhost, wants to substitute production URLs with local ports, or needs to route multiple services. Use when user says 'set up proxy', 'test localhost', 'tunnel to local', or before running tests against local development servers.
List all tables exposed via the Supabase PostgREST API to identify the attack surface.
Test if user signup is open and identify potential abuse vectors in the registration process.
Test Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.
Use this skill when the user doesn't yet know what to test. This is the "learn the site first" step — for unfamiliar websites, new projects, or any situation where Feature/Persona artifacts don't exist yet. Use when the user: gives a URL with no specific test in mind, asks what features or flows a site has, wants to explore or walk through a site, is new to a project, or says "explore before we test". Also use for bare "test [URL]" commands with no further context. Do not use when Feature artifacts already exist or the user references specific known tests or bugs.
HelpMeTest API library — write Robot Framework tests that make HTTP requests through the browser session (auth cookies included automatically). Use when user wants to test REST APIs, write API tests, chain requests, assert JSON fields, test CRUD flows, debug a failing API call, or use keywords like GET/POST/PUT/PATCH/DELETE/CURL. Triggers on: 'test the API', 'call this endpoint', 'check the response', 'POST /api/...', 'GET /api/...', 'write api tests', 'assert json', 'api returns 4xx', 'why is /api/x returning 401', 'debug this api call'. Also self-invokes when another test reveals an API call returning an unexpected status and you want to investigate or reproduce it in isolation.
Compare two security audit reports to track remediation progress and identify new vulnerabilities.