Supabase / skills/supabase-postgres-best-practices/SKILL.md
Supabase Postgres Best Practices
A topic-based SQL review guide covering query plans, schema design, connection management and row-level security.
Source reviewed · reviewed · Named sources were inspected. No runtime results are established by this label.
01 / Task fit
Where it may help.
These are intended uses indicated by the upstream material. They are not measured outcomes.
- Reviewing Postgres SQL, schema changes and RLS assumptions
- Planning query diagnostics before making performance changes
What it is
This skill points an agent to Postgres rules and SQL examples selected for the task at hand. Supabase maintains it, but much of the guidance applies to Postgres outside Supabase. The reviewed version is 1.1.1.
Why you might use it
Use it as a checklist when reviewing a query or migration. It makes the agent consider identity, privileges and diagnostic evidence alongside performance. The database role, schema and workload still determine whether a proposed change is correct.
Put it in context.
Illustrative requests and outputs to review. These examples are separate from the recorded evaluation below.
Review tenant access
Example request
Review this synthetic orders table and RLS policy. Identify the trusted user identity, role privileges and cases for two users who must not see each other's rows. Do not connect to a database.
What to look for. A proposed access-test matrix and a review of the policy assumptions.
Before you rely on it. A SQL review is not a passing tenant-isolation test. Execute allowed and denied cases in a disposable database before adoption.
Diagnose an order lookup
Example request
Review a synthetic query filtering orders by customer_id and status. Explain which execution-plan evidence would justify an index and what write overhead to measure.
What to look for. A narrow measurement plan and candidate index reasoning tied to the query.
Before you rely on it. EXPLAIN ANALYZE executes the query. A sequential scan is not automatically a defect, and an extra index has write and storage costs.
02 / Setup & access
What it asks of your environment.
Requirements
- An agent able to read the topic files and the relevant SQL or schema.
- A separately configured disposable Postgres database is needed for runtime validation; Supabase-specific auth.uid() examples need matching identity facilities.
- No account is needed to read the guide. Live Supabase access, connection strings and privileges are separate dependencies.
Permissions & data access
- Read SQL, schema and query plans.
- Any generated SQL executes with the connected database role. DDL, role grants and diagnostics need their own authorization.
Instructions alone do not enforce a sandbox. The agent host, connected tools and approvals determine what the skill can actually read, change or send.
03 / Things to check
Security concerns & practical limits.
These concerns follow from the reviewed sources. They describe possible exposure or required review; they are not confirmed vulnerabilities.
Higher attention
A tenant setting is not authentication
The generic policy example reads app.current_user_id. If a caller can choose or overwrite that value, the example alone does not prove tenant isolation. Test trusted identity setup and both allowed and denied rows under the actual application role.
Higher attention
Privileged helpers need caller-role tests
SECURITY DEFINER guidance crosses a privilege boundary. Verify schema exposure, search_path, EXECUTE grants and identity checks together; the sample revokes direct execution from named roles, so validate the intended policy call path before using it.
Review before use
Diagnostics and migrations can change state
EXPLAIN ANALYZE executes its query; schema, index and role examples also change the database. Use a disposable database or a reviewed maintenance plan before applying generated SQL.
Limits and nuances
- Source review of the entrypoint and six selected rules; not every rule in the repository. No Postgres process, SQL query, migration, Supabase project or authenticated RLS session was executed.
- No performance gain, tenant isolation guarantee, permission correctness, connection-pool compatibility or version-wide security conclusion is established.
04 / Review record
What we checked. What’s still open.
Recorded review scope
- skills/supabase-postgres-best-practices/SKILL.md
- LICENSE
- skills/supabase-postgres-best-practices/references/security-rls-basics.md
- skills/supabase-postgres-best-practices/references/security-privileges.md
- skills/supabase-postgres-best-practices/references/security-rls-performance.md
- skills/supabase-postgres-best-practices/references/monitor-explain-analyze.md
- skills/supabase-postgres-best-practices/references/query-missing-indexes.md
- skills/supabase-postgres-best-practices/references/conn-pooling.md
Not tested or established
- Source review of the entrypoint and six selected rules; not every rule in the repository. No Postgres process, SQL query, migration, Supabase project or authenticated RLS session was executed.
- No performance gain, tenant isolation guarantee, permission correctness, connection-pool compatibility or version-wide security conclusion is established.
- Review date
- Source revision
c9be0e931b7930f7d02126d04774d904c381e7d7- Our relationship
- Explored. Investigated through the recorded review. No use or replication is claimed.
Upstream content can change after review. A repository revision identifies source scope; it does not prove that every script, dependency or runtime behavior was tested. How freshness is handled.
Recorded evaluation / Source review
Results with their limits attached.
Completed 6 bounded source checks covering requirements, workflow boundaries and practical security concerns. No skill workflow was executed.
- Passed
- 6
- Failed
- 0
- Total recorded
- 6
These counts refer to the cases in this report. They are not a benchmark against other skills. A source review does not establish runtime behavior.
Read the evidence reportThe report provides the case definitions, observations and baseline scope. Missing baselines or untested behaviors remain limitations.
Recorded environment
- Pinned public UTF-8 sources; exact Git blob contents fetched through GitHub and recorded with SHA-256.
- Windows 11; Python 3.12.10 source-condition verification. No account, private document or live business data.
Recorded commands (2)
Commands document this evaluation. They are not setup instructions for your environment.
Read each pinned file listed in sourceManifest.python build-guide-reviews.py — verify the recorded source conditions and reconcile report counts.Findings from this evaluation
Higher attention
A tenant setting is not authentication
The generic policy example reads app.current_user_id. If a caller can choose or overwrite that value, the example alone does not prove tenant isolation. Test trusted identity setup and both allowed and denied rows under the actual application role.
Higher attention
Privileged helpers need caller-role tests
SECURITY DEFINER guidance crosses a privilege boundary. Verify schema exposure, search_path, EXECUTE grants and identity checks together; the sample revokes direct execution from named roles, so validate the intended policy call path before using it.
Needs attention
Diagnostics and migrations can change state
EXPLAIN ANALYZE executes its query; schema, index and role examples also change the database. Use a disposable database or a reviewed maintenance plan before applying generated SQL.
Observation
Performance figures were not reproduced
The source contains example timing and speedup claims. IonBin did not execute those workloads or adopt those figures as measured results.
Evaluation limitations
- Source review of the entrypoint and six selected rules; not every rule in the repository. No Postgres process, SQL query, migration, Supabase project or authenticated RLS session was executed.
- No performance gain, tenant isolation guarantee, permission correctness, connection-pool compatibility or version-wide security conclusion is established.
05 / Reuse & discovery
License, attribution & popularity.
MIT
Repository MIT license text inspected at this revision. Preserve its copyright and permission notice when redistributing covered source; separate dependencies and services can have their own terms.
Why it is in this collection
skills.sh displayed 450.4K installs for this named skill on the observation date. Rounded directory telemetry; not verified unique users, a quality score or measured growth.
450,400 skill installs on skills.sh
- Scope
- Directory listing for supabase-postgres-best-practices; not the whole repository
- Observed
- Time window
- Individual listing says Installs; reporting window not independently established
Popularity and inclusion do not establish quality, compatibility or security. Counts belong to their named metric and date; they are not a current ranking.
06 / Follow the evidence
Go to the original.
- Pinned skill instructions github.com
- Pinned repository license github.com
- Reviewed security-rls-basics.md github.com
- Reviewed security-privileges.md github.com
- Reviewed security-rls-performance.md github.com
- Reviewed monitor-explain-analyze.md github.com
- Reviewed query-missing-indexes.md github.com
- Reviewed conn-pooling.md github.com
- Dated directory popularity context www.skills.sh
IonBin’s source notes are independent assessments. Upstream authors retain their work and attribution. This page does not install or execute the skill.