Supabase Extract Jwt

The supabase-extract-jwt skill parses Supabase JWT tokens to reveal embedded claims, enabling agents to inspect user identity data without executing database queries. It is designed for security auditing and debugging scenarios where understanding token payload structure is critical.

When to use it

• Analyzing authentication tokens during penetration testing to verify scope and permissions.
• Debugging session issues by decoding claims to identify missing or incorrect user attributes.
• Validating that Supabase policies correctly restrict access based on specific JWT fields.
• Inspecting token expiration and issuer details in a secure, read-only manner.

Key capabilities

• Decodes standard Supabase JWT tokens automatically.
• Extracts and displays all claims within the token payload.
• Operates without requiring database write permissions or active connections.

Example prompts

• "Extract the user ID and role from this Supabase JWT token: [paste_token_here]"
• "Decode this authentication token and list all embedded claims for security review."
• "What does this JWT token claim about the current session's expiration time?"

Tips & gotchas

Ensure you provide a valid, unexpired Supabase JWT token to avoid parsing errors. This skill is intended for inspection only; do not use extracted data to forge new tokens or bypass authentication controls.