Supabase Agent Skills
Agent Skills to help developers using AI agents with Supabase, for more accurate and efficient development.
- Source repo
- supabase/agent-skills
- Stars
- ★ 2.9k
- Last updated
- 16d ago
- License
- MIT
- Primary language
- TypeScript
- FA score
- 43/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformChatGPT · Claude Code
- Cost
- Free, no paid service needed
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A developer integrating Supabase Auth with Next.js needs guidance on handling sessions and cookies; the supabase skill provides step-by-step instructions.
- Not a fit if
- Teams not using Supabase or Postgres
- Developers who cannot install Node.js and npx
- Teams needing a fully offline, cloud-free setup
- Source review
- 43/100 · Major gaps 8 safety controls not found
What does this agent do, and when should you use it?
Supabase Agent Skills is a repository of skill packages containing instructions, scripts, and resources for developers using AI agents with Supabase. The skills follow the Agent Skills open standard and are compatible with over 18 AI agents including Claude Code, GitHub Copilot, Cursor, and Cline. Two skills are currently available: 'supabase' (comprehensive coverage of all Supabase products and integrations) and 'supabase-postgres-best-practices' (Postgres performance optimization guidelines spanning 8 categories). Installation is straightforward via npx commands or as Claude Code plugins. The repository's release process includes a .well-known discovery mechanism to serve skills on supabase.com.
The repository provides skill folders that AI agents can discover and use, with each skill containing a SKILL.md manifest and optional references/ files. The 'supabase' skill covers all Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues), client libraries and SSR integrations, troubleshooting auth issues, and using the Supabase CLI or MCP server. The 'supabase-postgres-best-practices' skill provides Postgres performance optimization guidelines prioritized by impact, covering categories like query performance, connection management, schema design, concurrency & locking, security & RLS, data access patterns, monitoring & diagnostics, and advanced features. Users install skills via npx skills add or as Claude plugins. Once installed, AI agents automatically use the skills when relevant tasks are detected, such as optimizing queries or reviewing schema.
- A developer integrating Supabase Auth with Next.js needs guidance on handling sessions and cookies; the supabase skill provides step-by-step instructions.
- A database administrator wants to improve slow Postgres queries; the postgres-best-practices skill offers prioritized optimization strategies.
- A Claude Code user prefers installing skills as plugins to get automatic Supabase assistance during coding.
- A team wants to audit their database schema for security issues; the skill's RLS and security category provides a checklist.
- A developer using the Supabase CLI for migrations can leverage the skill to avoid common pitfalls.
How do you install or deploy this agent?
Run npx skills add supabase/agent-skills to install all skills, or npx skills add supabase/agent-skills --skill supabase to install a specific skill. Alternatively, for Claude Code, run claude plugin marketplace add supabase/agent-skills then claude plugin install supabase@supabase-agent-skills.
How do you use this agent?
After installation, AI agents will automatically use the skills when relevant tasks are detected. For example, you can ask your agent to 'Optimize this Postgres query' or 'Review my schema for performance issues', and the agent will load the skill's guidance to assist you.
What are this agent's strengths and limitations?
- Comprehensive coverage of Supabase's full product ecosystem, from database to auth and storage.
- Postgres best practices are categorized by impact, helping users focus on critical issues first.
- Supports 18+ AI agents, with flexible installation via npx or Claude plugins.
- Content is tailored to Supabase-specific workflows; may not be directly applicable to other databases or frameworks.
- Requires Node.js and npx for installation, which could be a barrier for non-Node developers.
- Advanced features like Postgres extensions may require deeper Supabase knowledge to fully utilize.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Supabase Agent Skills This agent | 43 · Major gaps | CLIFree | ★ 2.9k | 16d ago | TypeScript | ChatGPT · Claude Code |
| Agent Toolkit | 74 · Some gaps | CLIFree | ★ 19 | today | V | ChatGPT · Codex · Claude Code |
| Rulesync | 69 · Some gaps | CLIFree | ★ 1.5k | today | TypeScript | Codex · Claude Code |
| Agentic Plugin Marketplace | 66 · Some gaps | Agent plugin / skillFree + model costs | ★ 41k | 1d ago | Python | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows installation scripts and release workflows, but no specific implementation or documentation for least privilege, user confirmation, data flow transparency, sensitive data handling, dependency security, external effects, rollback, or source attribution. Therefore all trust criteria score 0.
Self-consistency: README, package.json, and tests are consistent on skill names and installation, score 2. Dependency availability: dependencies are listed in package.json but no lockfile or integrity checks, score 2. Failure messages: tests capture error output but no user-facing failure message design, score 1.
Audience and scenarios: README describes target audience and use cases, score 2. Capability boundaries: skill descriptions specify when to use, score 2. Trigger precision: skill descriptions provide usage conditions, score 2. Environment fit: supports multiple agents and installation methods, score 2.
Information architecture: README organizes skill list and structure clearly, score 2. Install notes: provides multiple installation methods, score 2. Naming stability: skill names are fixed, score 2. Examples and FAQ: provides examples but no FAQ, score 2. Known limitations: not explicitly listed, score 1. License: MIT license, score 2. Versioning and changelog: has version number but no changelog, score 2. Maintenance responsibility: has release workflow, score 2.
Output usability: skills provide instructions and references, score 2. Marginal value: provides official best practices, score 2. Cost-benefit: easy installation, score 2.
Claim traceability: claims in README lack sources, score 1. Cross-source corroboration: no independent sources, score 1. Fact-inference separation: not clearly distinguished, score 1.
- Not found in source: least-privilege scopingGrant only what the task needs: a dedicated account or read-only token, scoped to specific directories and repos.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: data-flow disclosureWatch which external services it contacts (proxy or firewall logs) and keep sensitive data out until you know where it goes.
- Not found in source: sensitive-data handlingUse dedicated, low-privilege, revocable API keys — never production credentials — and keep secrets out of logs.
- Not found in source: dependency securityPin versions and run a dependency audit (npm audit, pip-audit) before installing; prefer running it in a container.
- Not found in source: disclosed external effectsEstablish which external systems it writes to, sends to or changes, and verify with test accounts or repos before production.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Not found in source: verifiable attributionInstall from the official repo or registry and check the publisher and URL to avoid look-alike packages.
- No security mechanisms such as least privilege, user confirmation, or data flow transparency are provided; installation scripts may execute arbitrary code.
- Dependencies are not locked, posing supply chain risks.
- Release workflow uses GitHub App tokens without specifying permission scopes.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
[0.1.9](https://github.com/supabase/agent-skills/compare/v0.1.8...v0.1.9) (2026-09-24) Bug Fixes * supabase: recommend scoped personal access tokens for the Management API, CLI, and MCP ([#604](https://github.com/supabase/agent-skills/issues/604)) ([551274e](https://github.com/supabase/agent-skills/commit/551274ed2fe97c8fea1325f7ceb05803a542f8df))View on GitHub ↗ -
Release notes excerpt
[0.1.8](https://github.com/supabase/agent-skills/compare/v0.1.7...v0.1.8) (2026-08-12) Features * supabase: add debugging workflows to the supabase skill ([#112](https://github.com/supabase/agent-skills/issues/112)) ([3a4f0ce](https://github.com/supabase/agent-skills/commit/3a4f0ce0782e0cbdcf187c362e8d15d9e324462b))View on GitHub ↗ -
Release notes excerpt
[0.1.7](https://github.com/supabase/agent-skills/compare/v0.1.6...v0.1.7) (2026-07-30) Bug Fixes * supabase-postgres-best-practices: make skill description trigger-rich ([#194](https://github.com/supabase/agent-skills/issues/194)) ([3291216](https://github.com/supabase/agent-skills/commit/32912161e2732c3e5001c6811a76c1f8308ed0da))View on GitHub ↗