Supabase / skills/supabase/SKILL.md
Supabase
Supabase's general skill for agents: check current docs first, verify every fix, and follow a security checklist for auth, RLS, keys and storage.
Source reviewed · reviewed · Named sources were inspected. No runtime results are established by this label.
01 / Task fit
Where it may help.
These are intended uses indicated by the upstream material. They are not measured outcomes.
- Building or changing Supabase projects with an agent
- A security checklist for auth, RLS, keys and storage
What it is
This is Supabase's broad skill for any Supabase task: database, auth, Edge Functions, storage and client libraries. It tells the agent to check the changelog and current docs before implementing, to run a test after every fix, and to stop retrying after a few failed attempts. A security checklist covers common traps, such as views that bypass row-level security and keys exposed in frontend code.
Why you might use it
Use it when an agent builds or changes a Supabase project, alongside the narrower Postgres best-practices skill. The checklist is the most useful part for small teams without a dedicated security reviewer.
Put it in context.
Illustrative requests and outputs to review. These examples are separate from the recorded evaluation below.
Add a table safely
Example request
Add a bookings table with row-level security so each signed-in user sees only their own rows. Test both an allowed and a denied read.
What to look for. A migration, policies combining role and ownership, and two test results.
Before you rely on it. Test with real user roles in a non-production project. A passing policy review isn't a passing test.
Fix an inaccessible table
Example request
A table I created in SQL isn't reachable from the app. Check the Data API settings and grants before changing anything.
What to look for. A diagnosis naming the missing exposure or grant, and a proposed fix.
Before you rely on it. Granting anon access exposes data publicly. Enable row-level security before any public grant.
02 / Setup & access
What it asks of your environment.
Requirements
- A Supabase project and either the Supabase CLI or the Supabase MCP server.
- A scoped personal access token for CI or agents, per the skill.
Permissions & data access
- Reads docs and project files, and runs SQL or CLI commands against the connected project.
- Schema changes, grants and policies change the database. Use a development project first.
Instructions alone do not enforce a sandbox. The agent host, connected tools and approvals determine what the skill can actually read, change or send.
03 / Things to check
Security concerns & practical limits.
These concerns follow from the reviewed sources. They describe possible exposure or required review; they are not confirmed vulnerabilities.
Higher attention
SQL runs with real privileges
The skill uses execute_sql and CLI commands that change schemas and policies. Point it at a development project and review migrations before they reach production.
Review before use
Login tokens can be broader than needed
The skill notes that the CLI browser login creates a full-access token. Use scoped tokens for agents and CI.
Limits and nuances
- Source review of SKILL.md and the repository license only. Linked Supabase docs were not reviewed.
- No Supabase project was connected and no SQL was run. No security guarantee is claimed.
04 / Review record
What we checked. What’s still open.
Recorded review scope
- skills/supabase/SKILL.md
- LICENSE
Not tested or established
- Source review of SKILL.md and the repository license only. Linked Supabase docs were not reviewed.
- No Supabase project was connected and no SQL was run. No security guarantee is claimed.
- Review date
- Source revision
c9be0e931b7930f7d02126d04774d904c381e7d7- Our relationship
- Explored. Investigated through the recorded review. No use or replication is claimed.
Upstream content can change after review. A repository revision identifies source scope; it does not prove that every script, dependency or runtime behavior was tested. How freshness is handled.
Recorded evaluation / Source review
Results with their limits attached.
Completed 5 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.
- Passed
- 5
- Failed
- 0
- Total recorded
- 5
These counts refer to the cases in this report. They are not a benchmark against other skills. A source review does not establish runtime behavior.
Read the evidence reportThe report provides the case definitions, observations and baseline scope. Missing baselines or untested behaviors remain limitations.
Recorded environment
- Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.
- Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data.
Recorded commands (2)
Commands document this evaluation. They are not setup instructions for your environment.
Read each pinned file listed in sourceManifest.python3 r6_skills.py: check each recorded source condition and reconcile report counts.Findings from this evaluation
Higher attention
SQL runs with real privileges
The skill uses execute_sql and CLI commands that change schemas and policies. Point it at a development project and review migrations before they reach production.
Needs attention
Login tokens can be broader than needed
The skill notes that the CLI browser login creates a full-access token. Use scoped tokens for agents and CI.
Observation
Verify every fix
The skill treats a fix without a test query as incomplete.
Evaluation limitations
- Source review of SKILL.md and the repository license only. Linked Supabase docs were not reviewed.
- No Supabase project was connected and no SQL was run. No security guarantee is claimed.
05 / Reuse & discovery
License, attribution & popularity.
MIT
MIT license text inspected at this revision. Keep the copyright and permission notice when redistributing covered files. The services and accounts the skill uses have their own terms.
Why it is in this collection
GitHub displayed 2,879 stars for the supabase/agent-skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.
2,879 repository stars
- Scope
- Entire supabase/agent-skills repository, not this individual skill
- Observed
- Time window
- Snapshot observed 2026-10-19
Popularity and inclusion do not establish quality, compatibility or security. Counts belong to their named metric and date; they are not a current ranking.
06 / Follow the evidence
Go to the original.
- Pinned skill instructions github.com
- Pinned license github.com
- Repository (dated star count) github.com
IonBin’s source notes are independent assessments. Upstream authors retain their work and attribution. This page does not install or execute the skill.