Supabase Development Guide
Practical guidance for AI agents building, securing, and migrating Supabase applications.
The skill provides a substantial security checklist covering RLS, key exposure, SECURITY DEFINER, storage permissions, and dependency locking, and asks agents to consult documentation and logs. However, database, MCP, and migration actions lack consistent user confirmation, least-privilege boundaries, or rollback procedures; data-flow and sensitive-data handling are also incomplete. The publisher is unverified, so trust is reduced.
The instructions are organized and include CLI version gates, MCP/psql fallbacks, and a clear stop-and-reconsider rule after repeated failure. However, operation depends on live external documentation and changing CLI versions, while abnormal-input, authentication-failure, and unavailable-service diagnostics are incomplete. No dedicated tests cover the skill's core guidance, so the static score is limited.
The target audience and major Supabase scenarios are clear, but triggering on “ANY task” is prone to false positives, and non-fit boundaries, input/output boundaries, and trigger priority are unspecified. Chinese-language support is not addressed, and core verification depends on overseas Supabase documentation, MCP, and service endpoints whose mainland-China reachability is not established.
The package has standard frontmatter, installation guidance, version metadata, a changelog, an MIT license, references, feedback handling, CI, and release automation. However, the skill version 0.1.2 conflicts with the shown changelog/package versions, maintenance ownership and update commitments are not fully explicit, and examples, FAQs, limitations, and troubleshooting coverage are limited.
The skill covers Supabase products, client integrations, CLI, MCP, schema changes, and common security pitfalls; its checklist and migration guidance can directly help with core tasks. However, it does not define a consistent output format or completion criteria, and results depend on external documentation, tool permissions, and project state. Static evidence cannot establish directly usable outcomes.
Official documentation links, version conditions, a changelog, CI workflows, and installation sanity tests provide limited auditability. Nevertheless, the tests mainly cover installation and skill discovery rather than the skill's key guidance, while security and product claims lack itemized sourcing or independent reproduction evidence. Static review cannot verify runtime behavior.
- Add explicit user confirmation, permission scope, sensitive-data protections, and recoverable rollback steps before database, migration, authorization, or MCP operations.
- Reconcile the skill version metadata with the CHANGELOG and package.json versions before relying on release identity.
- The “any Supabase task” trigger is overly broad; define non-fit cases and output requirements, and verify mainland-China reachability for documentation, MCP, and service endpoints.
- The existing CI does not validate the security advice, CLI procedures, or migration key paths and should not be treated as proof of runtime correctness.
What does this skill do, and when should you use it?
This is Supabase’s Agent Skill for developers who use AI agents with Supabase. It covers Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues, client libraries, SSR integrations, the CLI, MCP, and Postgres extensions. The skill instructs agents to check the changelog and current documentation before implementation, then verify their work. It also includes concrete security guidance for RLS, JWT claims, views, privileged functions, Storage, and exposed keys.
It directs agents to fetch the Supabase changelog and relevant documentation, inspect breaking-change entries, discover CLI commands with supabase --help, check the CLI version, and verify fixes with test queries. It provides procedures for checking MCP reachability, .mcp.json configuration, and OAuth authentication. Where applicable, it references MCP operations such as search_docs, execute_sql, and get_advisors. It also guides agents through declarative-schema and imperative-migration workflows, including generating, reviewing, and verifying migrations.
- Developers integrating Supabase clients or SSR with Next.js, React, SvelteKit, Astro, or Remix.
- Teams troubleshooting login, logout, sessions, JWTs, cookies, `getSession`, `getUser`, `getClaims`, or RLS.
- Engineers designing schemas, writing migrations, using declarative schemas, or operating the Supabase CLI or MCP server.
- Developers auditing implementations involving Auth, RLS, views, Storage, user data, or privileged Postgres functions.
- Teams working on Postgres queries, indexes, connection pooling, or RLS that also want to use the repository’s separate Postgres best-practices skill.
What are this skill's strengths and limitations?
- Broad coverage of Supabase products, client integrations, CLI, MCP, schema changes, and security audits.
- Includes specific checks for RLS, JWT claims, views, SECURITY DEFINER functions, Storage, and key exposure.
- Distinguishes declarative-schema and imperative-migration workflows.
- MIT licensed and described as compatible with more than 18 AI agents.
- Relies on current Supabase documentation, network access, and potentially a configured CLI or MCP environment.
- Some CLI and MCP workflows have explicit version or authentication prerequisites; older CLI versions require fallbacks.
- The supplied metadata does not identify a fixed skill path, and the source does not provide a test suite or test results.
How do you install this skill?
Install the specific skill with the command provided in the README: npx skills add supabase/agent-skills --skill supabase. To install all skills, run npx skills add supabase/agent-skills. Claude Code users can also add the repository as a marketplace and run claude plugin install supabase@supabase-agent-skills. The supplied repository metadata does not document a fixed skill path.
How do you use this skill?
After installation, give the agent a concrete request such as Help me set up Supabase Auth with Next.js, Review my Supabase RLS policies, or Create a migration for this schema change. The agent should consult the current changelog and documentation first, then run a test query or other relevant verification after making changes.