Supabase Official's master skill: For any task involving Supabase database, authentication, Edge Functions, Realtime, storage, CLI, or MCP, the agent is required to check the latest changelog and documentation before acting, run query verification after making changes, and cross-reference a Supabase-specific security checklist.
skills.sh installs 348296 (+1522 / 24h)
Security Audit: Not audited
- Not yet scanned
Rationale
- The security checklist translates into specific practices: do not use user-modifiable user_metadata for authorization; service_role / secret keys must not be included in the frontend, as NEXT_PUBLIC_ variables in Next.js are sent to the browser; views bypass RLS by default, so use security_invoker in Postgres 15 and later; UPDATE policies must include both USING and WITH CHECK clauses; do not add SECURITY DEFINER functions to resolve permission errors
- When modifying table structures, first determine whether the project uses declarative schema or imperative migrations; for imperative migrations, use execute_sql or supabase db query for iteration, do not use apply_migration to modify the local database, run advisors before finalizing, and then use db pull to generate migrations
- If the same approach fails 2–3 times, stop, change strategy, and check logs instead of retrying in place
- skills.sh installs 1522 per 24 hours, cumulative 348296, with weekly installs between 11380–12605 over the last 8 weeks (indicating attention only)
Usage
- Requires a Supabase project; when using the CLI, note version requirements (the author states db query requires v2.79.0+, db advisors requires v2.81.3+), or connect to Supabase MCP (https://mcp.supabase.com/mcp，OAuth login)
- In CI and agents, use scoped personal access tokens (SUPABASE_ACCESS_TOKEN), not full-permission tokens generated via browser login
Risks
- Not audited in this release, fixed at C-level, install command not displayed
- Causes the agent to read changelogs and documentation from supabase.com online and execute SQL directly against the database; MCP connects to your real project, and the author warns that classic tokens have account-wide permissions, and commands using database passwords are not restricted by token scopes
- If .mcp.json is missing, SKILL.md instructs the agent to create it in the project root directory