Supabase Agent Skills

supabase/agent-skills is Supabase's official skill repository for AI coding agents. It packages task-specific instructions and references so agents can work more reliably with Supabase products, Supabase CLI, Supabase MCP, Row Level Security, migrations, and Postgres performance.

The repository currently publishes two skills:

• supabase: broad Supabase development guidance covering Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues, client libraries, SSR integrations, CLI, MCP, migrations, RLS, security audits, and extensions.
• supabase-postgres-best-practices: Postgres performance and design guidance from Supabase, organized across query performance, connection management, security and RLS, schema design, locking, access patterns, monitoring, and advanced features.

Use this entry when an agent needs reusable Supabase operating guidance. Use a separate Supabase MCP listing when the question is specifically about connecting an agent to Supabase's hosted MCP tools.

Knowledge Freshness

Supabase products, CLI commands, MCP behavior, SSR helpers, Auth guidance, Postgres features, and security recommendations change frequently. The broad supabase skill explicitly instructs agents to verify current docs and changelog context before implementing features instead of relying on model memory.

For exact implementation details, pair the skills with current Supabase docs, the Supabase MCP server, supabase --help, package-specific documentation, and the actual version installed in the target project.

Retrieval Sources

This listing is grounded in:

• Supabase's official supabase/agent-skills repository.
• Supabase's Agent Skills docs page.
• Supabase's .well-known/agent-skills/ discovery index.
• The supabase skill manifest.
• The supabase-postgres-best-practices skill manifest.
• Repository package metadata, which identifies the package as official Supabase agent skills under MIT licensing.

Core Workflow

Install all Supabase skills:

npx skills add supabase/agent-skills

Install a focused skill:

npx skills add supabase/agent-skills --skill supabase
npx skills add supabase/agent-skills --skill supabase-postgres-best-practices

Claude Code users can also install Supabase's skill marketplace and plugins:

claude plugin marketplace add supabase/agent-skills
claude plugin install supabase@supabase-agent-skills
claude plugin install postgres-best-practices@supabase-agent-skills

The .well-known/agent-skills/ endpoint publishes archive URLs and SHA-256 digests for released skill bundles. That makes it useful for agents and installers that support Agent Skills discovery metadata.

Capability Scope

The broad supabase skill applies to product-wide Supabase development:

• Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, and Queues.
• supabase-js, @supabase/ssr, and integrations for frameworks such as Next.js, React, SvelteKit, Astro, and Remix.
• Auth troubleshooting for sessions, JWTs, cookies, getSession, getUser, getClaims, RLS, and login/logout flows.
• Supabase CLI, Supabase MCP, schema changes, migrations, security audits, and extensions such as pg_graphql, pg_cron, and pg_vector.

The Postgres best-practices skill focuses on query optimization, indexes, connection pooling, schema design, concurrency, locking, security, RLS, monitoring, diagnostics, and advanced Postgres features.

Production Rules

Treat Supabase work as production-sensitive when it touches data, identity, authorization, or migrations.

• Review generated SQL, policies, triggers, views, and functions before they run against shared or production databases.
• Never expose service_role keys, secret keys, database passwords, JWT secrets, OAuth secrets, or connection strings in public clients or prompts.
• Enable and review RLS for tables in exposed schemas instead of relying on role grants alone.
• Avoid using user-editable metadata in authorization decisions.
• Be careful with SECURITY DEFINER, views, storage upserts, migration history, and SQL execution through MCP or CLI tools.
• Run Supabase advisors, tests, and real verification queries when a change affects schema, access control, or performance.

Use Cases

• Ask Claude Code to set up Supabase Auth with SSR while checking current docs.
• Have Codex review RLS policies for common Supabase-specific mistakes.
• Use Cursor to optimize a slow Postgres query with Supabase's index and connection-management guidance.
• Ask an agent to generate a migration plan, then inspect and validate the SQL before applying it.
• Pair the skills with Supabase MCP docs access so the agent can retrieve current product documentation while following the skill's security workflow.

Source Review

• The repository README describes Supabase Agent Skills as folders of instructions, scripts, and resources for agents, compatible with Claude Code, GitHub Copilot, Cursor, Cline, and other agents.
• Supabase's docs page documents npx skills add supabase/agent-skills, focused --skill installation, project-scope installation, and the relationship to Supabase's combined plugin setup.
• The .well-known/agent-skills/ endpoint exposes supabase and supabase-postgres-best-practices archives with SHA-256 digests.
• The supabase skill manifest lists product-wide Supabase triggers and includes security-sensitive guidance for RLS, Data API exposure, JWT claims, service-role keys, views, storage, dependency pinning, CLI usage, and MCP setup.
• The Postgres best-practices skill manifest describes eight prioritized categories covering performance, connection management, schema design, locking, security, access patterns, monitoring, and advanced features.

Duplicate Review

Checked current content/skills/, content/mcp/, content/tools/, open pull requests, and repository-wide content for Supabase Agent Skills, supabase/agent-skills, supabase-postgres-best-practices, Supabase skills, and Supabase MCP skill. Existing Supabase content covers realtime database skills and Supabase expert rules, but no dedicated official Supabase Agent Skills entry, exact source URL duplicate, target file, or open duplicate PR was found.

Disclosure

Editorial listing. No paid placement or affiliate link is used. Supabase Agent Skills are published by Supabase under MIT package metadata. Supabase also offers hosted commercial infrastructure and platform services.