Supabase Agent Skill

Curated by Skill Harbor — the master agent skill for all Supabase work from the Supabase team, applying to any task touching the database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, or Queues: three non-negotiable core principles — verify against the changelog and current docs before implementing (Supabase changes frequently; never trust training data), verify every fix with a test query (a fix without verification is incomplete), and recover from errors instead of looping (after 2–3 failed attempts, reconsider the approach). It ships a Supabase-specific security checklist the agent must run on any auth/RLS/view/storage/user-data task — never use `user_metadata` claims for authorization (user-editable; use `app_metadata`), never expose the `service_role` key in public clients, remember views bypass RLS (use `security_invoker = true` on Postgres 15+), UPDATE requires a SELECT policy, `auth.role()` is deprecated (use the `TO` clause, and `TO authenticated` alone is authentication without authorization — combine it with an ownership predicate in `USING`, plus `WITH CHECK` on UPDATE policies), `SECURITY DEFINER` functions bypass RLS and are callable by all roles in `public`, storage upsert needs INSERT + SELECT + UPDATE, and always pin package versions with lockfiles. It also covers CLI gotchas (discover via `--help` — never guess; `db query` needs CLI v2.79.0+, `db advisors` v2.81.3+; scoped personal access tokens over full-access classic tokens in CI), MCP server setup and connection troubleshooting (401 on the health endpoint is expected; OAuth 2.1 auth flow), docs lookup priority (MCP `search_docs`, then docs pages fetched as markdown), and schema workflows — declarative schemas edited first then migrated, or imperative migrations where `execute_sql`/`supabase db query` iterate freely and migrations are only generated when ready (`supabase migration new`, never invented filenames; never use `apply_migration` to iterate). By @supabase, listed here with credit to its creator. Honest caveats: this is a master policy skill, not a step-by-step product tutorial — pair it with the product docs it points to; the Data API vs RLS distinction (exposing tables is separate from row visibility) and the security checklist are the parts most people get wrong, so read them before touching auth or policies. Skill Harbor never reviews the code, review it yourself before use.