Extract the Supabase project URL from client-side JavaScript code, environment variables, and configuration files.

Supabase URL Extraction 🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED You MUST write to context files AS YOU GO , not just at the end. Write to .sb pentest context.json IMMEDIATELY after each discovery Log to .sb pentest audit.log BEFORE and AFTER each action DO NOT wait until the skill completes to update files If the skill crashes or is interrupted, all prior findings must already be saved This is not optional. Failure to write progressively is a critical error. This skill extracts the Supabase project URL from a web application's client side code. When to Use This Skill After detecting Supabase usage, to get the exact project URL When you need the API base URL for further testing To identify which Supabase project an application uses Prerequisites Target URL accessible Supabase usage detected (or suspected) How It Works The skill scans for URL patterns in: 1. JavaScript Source Code 2. HTML Meta Tags and Scripts 3. Configuration Objects URL Pattern Matching Recognized patterns: Pattern Example Standard https://abc123.supabase.co With region https://abc123.eu central 1.supabase.co Custom domain Detected via API endpoint patterns Usage Basic Extraction From Local Files If you have downloaded the source: Output Format Context Output Saved to .sb pentest context.json : Multiple URLs If multiple Supabase URLs are found: Validation The skill validates extracted URLs by: 1. Format check — Matches expected Supabase URL patterns 2. Reachability check — Attempts to reach the REST API endpoint 3. Response validation — Confirms Supabase like response Common Issues ❌ Problem: URL not found despite Supabase detection ✅ Solution: The URL may be in a dynamically loaded chunk. Try: ❌ Problem: URL found but validation fails ✅ Solution: The project may be paused or the region may have connectivity issues. The URL is still recorded. ❌ Problem: Only custom domain found ✅ Solution: Custom domains are valid. The skill will note it as a custom domain and attempt to identify the underlying project. Security Notes This skill only reads publicly available code No authentication is attempted The URL alone does not grant access (key is also required) Next Steps After extracting the URL: 1. Run supabase extract anon key to find the API key 2. Run supabase extract service key to check for leaked service keys 3. Proceed to API auditing skills MANDATORY: Progressive Context File Updates ⚠️ This skill MUST update tracking files PROGRESSIVELY during execution, NOT just at the end. Critical Rule: Write As You Go DO NOT batch all writes at the end. Instead: 1. Before starting any action → Log the action to .sb pentest audit.log 2. After each discovery → Immediately update .sb pentest context.json 3. After each significant step → Log completion to .sb pentest audit.log This ensures that if the skill is interrupted, crashes, or times out, all findings up to that point are preserved. Required Actions (Progressive) 1. Update .sb pentest context.json with extracted data: 2. Log to .sb pentest audit.log : 3. If files don't exist , create them before writing. FAILURE TO UPDATE CONTEXT FILES IS NOT ACCEPTABLE. MANDATORY: Evidence Collection 📁 Evidence Directory: .sb pentest evidence/02 extraction/ Evidence Files to Create File Content extracted url.json URL extraction details with source locations Evidence Format Related Skills supabase detect — Detect Supabase usage first supabase extract anon key — Extract the anon key supabase extract service key — Check for service key leaks

supabase-extract-url