A Postgres ruleset maintained by Supabase: load it first when agents write SQL, create or alter tables, write migrations, configure RLS policies, add indexes, or troubleshoot slow queries, connection exhaustion, locks, and table bloat. It categorizes rules into 8 classes by impact, providing incorrect and correct SQL examples for each rule.
skills.sh installs 468744 (+1162 / 24h)
Security Audit: Not audited
- Not yet scanned
Rationale
- The 8 classes are prioritized: query performance, connection management, and security/RLS are marked CRITICAL, followed by table schema design, concurrency and locks, data access patterns, monitoring and diagnostics, and advanced features; rule files are stored under references/ with prefixes such as query-, conn-, and security-
- The trigger scope is broad: loading is required even for changing a single column or writing a single query, and it covers pg_cron, pgmq queues, pgvector vector search, and pg_restore imports
- Each rule includes the rationale, incorrect and correct SQL examples, optional EXPLAIN output, and Supabase-specific notes where necessary; the author states it is not limited to Supabase and can be used with any Postgres instance
- MIT licensed, version 1.1.1; skills.sh shows 1162 installs in the last 24 hours, with a cumulative total of 468744 (indicating attention only)
Usage
- The installation command will appear after the audit passes; the README also provides a Claude Code plugin method: run
claude plugin marketplace add supabase/agent-skills, thenclaude plugin install postgres-best-practices@supabase-agent-skills - No Supabase account or services are required; it consists of plain-text rules, and agents read individual rule files under references/ on demand
Risks
- Not audited in this cycle, fixed at C-level, and the installation command is not displayed; SKILL.md contains only text and reference links, with no scripts or network requests; all three third-party audits on skills.sh returned Pass
- This review only examined the summary table in SKILL.md; the specific rules under references/ were not read individually; the broad trigger scope means it loads whenever Postgres is touched, consuming context
- The rules originate from Supabase, and some recommendations (such as connection pooling and RLS syntax) reflect Supabase platform conventions; self-hosted Postgres users must exercise their own judgment