Individual skill
supabase
Use when building on Supabase as a backend over managed Postgres — wiring the supabase-js or SSR client, writing or debugging Row Level Security, cookie-based Auth, Storage buckets, Realtime, and Edge Functions, including local versus server JWT verification and the service-role key. NOT raw Postgres tuning (that is `postgresdb`).
skills/supabase/SKILL.md
Source commit d9d6bb338f66cc1e23998585e580a0ea45bbcb82
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 10, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 574
- Repository last updated
- Nov 9, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- agentic-ai Repository topic
- ai-agents Repository topic
- ai-coding Repository topic
- claude-code Repository topic
- cli Repository topic
- cline Repository topic
- codex Repository topic
- coding-assistant Repository topic
- cursor Repository topic
- supabase Declared skill tag
- postgres Declared skill tag
- rls Declared skill tag
- auth Declared skill tag
- edge-functions Declared skill tag
- realtime Declared skill tag
- storage Declared skill tag
- baas Declared skill tag
- writing Derived category
- security Derived category
- testing Derived category
- data Derived category
- data-databases Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 14,032 bytesSKILL.mdcore · 14,032 bytesevals/README.mddoc · 923 bytesevals/cases.yamlasset · 3,220 bytesreferences/auth-ssr.mddoc · 6,167 bytesreferences/rls-cookbook.mddoc · 3,791 bytesscripts/verify.shruns · 6,234 bytes
Read excerpt
# Supabase — Postgres with RLS as the auth layer
Supabase is a managed Postgres database wrapped in thin SDKs, a PostgREST data API, Auth, Storage,
Realtime, and Deno Edge Functions. The one sentence that explains every footgun below:
> **Your authorization lives in the database (Row Level Security), not in your app code.**
The browser holds a key that can hit your database directly. That is safe *only* because RLS gates
every row. Get that wrong and you either leak everything or see nothing. Everything in this skill is
downstream of that fact. You can write SQL already — what you need is Supabase's specific abstractions
and where the trust boundary sits.
Use the current packages: **`@supabase/supabase-js` v2** (v1 is security-fixes only) and
**`@supabase/ssr`** for server frameworks (it replaced the deprecated `auth-helpers`).