supabase

Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps l…

supabase ↓ 179k

Claude Code

View source ↗

What it does

Auth and session security
If you use appmetadata or auth.jwt() for authorization, remember JWT claims are not always fresh until the user's token is refreshed.
API key and client exposure
RLS, views, and privileged database code
UPDATE policies require both USING and WITH CHECK. Without WITH CHECK, a user can reassign a row's userid to another user:
Storage access control
Storage upsert requires INSERT + SELECT + UPDATE. Granting only INSERT allows new uploads but file replacement (upsert) silently fails. You need all three.

Requirements & configuration

If you use appmetadata or auth.jwt() for authorization, remember JWT claims are not always fresh until the user's token is refreshed.
API key and client exposure
UPDATE requires a SELECT policy. In Postgres RLS, an UPDATE needs to first SELECT the row. Without a SELECT policy, updates silently return 0 rows — no error, just no change.
UPDATE policies require both USING and WITH CHECK. Without WITH CHECK, a user can reassign a row's userid to another user:
Storage upsert requires INSERT + SELECT + UPDATE. Granting only INSERT allows new uploads but file replacement (upsert) silently fails. You need all three.

Configuration: GRANTNEXT_PUBLIC_CREATEUSINGWITHSECURITYEXECUTEPUBLIC

Derived from the skill's own SKILL.md documentation · extracted 2026-07-23

Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...

Source

Repository: https://github.com/supabase/agent-skills

supabase FAQ

What does the supabase skill do?

Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, declarative schemas, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector). Auth and session security If you use appmetadata or auth.jwt() for authorization, remember JWT claims are not always fresh until the user's token is refreshed.

What does supabase require?

If you use appmetadata or auth.jwt() for authorization, remember JWT claims are not always fresh until the user's token is refreshed. API key and client exposure UPDATE requires a SELECT policy. In Postgres RLS, an UPDATE needs to first SELECT the row. Without a SELECT policy, updates silently return 0 rows — no error, just no change. UPDATE policies require both USING and WITH CHECK. Without WITH CHECK, a user can reassign a row's userid to another user: Storage upsert requires INSERT + SELECT + UPDATE. Granting only INSERT allows new uploads but file replacement (upsert) silently fails. You need all three. Configuration keys: GRANT, NEXT_PUBLIC_, CREATE, USING, WITH, SECURITY, EXECUTE, PUBLIC.

How do I install supabase?

Run: npx -y skills add https://github.com/supabase/agent-skills --skill supabase --agent claude-code — the source lives at github.com/supabase/agent-skills.

Maintain supabase?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[![supabase on getagentictools](https://getagentictools.com/badge/skills/supabase-agent-skills-supabase.svg)](https://getagentictools.com/skills/supabase-agent-skills-supabase?ref=badge)

npx agentictools info skills/supabase-agent-skills-supabase

The second line is the CLI lookup for this page — handy in READMEs and docs.