Bucket File Access Test 🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED You MUST write to context files AS YOU GO , not just at the end. Write to .sb pentest context.json IMMEDIATELY after each bucket tested Log to .sb pentest audit.log BEFORE and AFTER each file access test DO NOT wait until the skill completes to update files If the skill crashes or is interrupted, all prior findings must already be saved This is not optional. Failure to write progressively is a critical error. This skill tests actual file access in storage buckets to verify permissions. When to Use This Skill After listing buckets, to verify actual access To test storage RLS policy effectiveness To check for sensitive file exposure To document what files are accessible Prerequisites Buckets listed (auto invokes if needed) Anon key available How It Works The skill attempts to: 1. List files in each bucket 2. Read file metadata 3. Download sample files (for content type verification) 4. Check public URL access Important: This is READ ONLY. No files are modified or deleted. Test Approach Bucket Type Tests Performed Public Direct URL access, listing, metadata Private API listing with anon key, authenticated access Usage Basic Read Test Specific Bucket List Only (No Download) Output Format Sensitive File Detection The skill identifies sensitive files by: Filename Patterns Pattern Risk Type .sql , backup P0 Database dumps .env , secrets P0 Secret files password , credential P0 Credentials invoice , payment P1 Financial contract , agreement P1 Legal id , passport , license P1 Identity export , dump P1 Data exports Content Detection For accessible files, the skill samples content for: API keys (patterns like sk live , pk test ) Database credentials JWT secrets Personal information patterns Context Output Remediation Steps For Exposed Secrets For Public Bucket Fix For Upload Bucket Common Issues ❌ Problem: Cannot list files in private bucket ✅ Solution: This is correct behavior. RLS is working. ❌ Problem: Large number of files to scan ✅ Solution: Use sampling mode for large buckets. ❌ Problem: File download fails ✅ Solution: May be RLS restriction or network issue. MANDATORY: Progressive Context File Updates ⚠️ This skill MUST update tracking files PROGRESSIVELY during execution, NOT just at the end. Critical Rule: Write As You Go DO NOT batch all writes at the end. Instead: 1. Before testing each bucket → Log the action to .sb pentest audit.log 2. After each sensitive file found → Immediately update .sb pentest context.json 3. After each bucket completed → Log the summary This ensures that if the skill is interrupted, crashes, or times out, all findings up to that point are preserved. Required Actions (Progressive) 1. Update .sb pentest context.json with results: 2. Log to .sb pentest audit.log : 3. If files don't exist , create them before writing. FAILURE TO UPDATE CONTEXT FILES IS NOT ACCEPTABLE. MANDATORY: Evidence Collection 📁 Evidence Directory: .sb pentest evidence/04 storage audit/buckets/ Evidence Files to Create File Content buckets/[name]/file list.json Files found in bucket buckets/[name]/sensitive files.json Sensitive files detected buckets/[name]/sample contents/ Redacted content samples Evidence Format (Sensitive Files Exposed) Add to curl commands.sh Related Skills supabase audit buckets list — List buckets first supabase audit buckets public — Focus on public access issues supabase report — Generate full report

supabase-audit-buckets-read