Supabase skill and other backend skills, compared

The Supabase skill is one of several vendor-written skills that teach an agent how to use a backend platform correctly: Auth, row level security, migrations, CLIs and MCP servers. This category collects those, plus database rulebooks and framework skills for server code. We reviewed 27: 14 get an install verdict and 13 come with caveats. Only one is clean.

Vendor skills are useful because they carry current, platform-specific knowledge the model may lack or get wrong. They also lean toward their own product, and they act on your project with your credentials.

What to look for in a Supabase skill or other backend skill

Check what the skill does with credentials. A sound one tells the agent to prefer scoped tokens and use the CLI or MCP server with your own project keys. A weak one writes an API key into your agent config or sends reports to the vendor without telling you.

Check how it fetches knowledge. Several skills tell the agent to read the vendor’s live docs or changelog at run time. That keeps advice current, but it means the instructions can change without a repository change. Check CLI pinning too: npx tool@latest runs whatever is newest.

Check whether it can change data. Schema changes and deployments need a human review of the SQL or the plan. For a production database, give the agent a read-only role. Of the 27 skills, 1 is clean, 20 are marked “review” and 6 have broad access. The security page explains the labels, and the skills docs explain which permissions a skill can pre-approve.

Recommended backend skills

• Supabase Agent Skills is the official pair: a general Supabase skill covering the CLI, MCP, Auth, RLS and migrations, and a Postgres best-practices guide. It tells the agent to read Supabase’s changelog and docs at run time and to use the CLI or MCP with credentials you provide. The only scripts are release and test tooling. It has about 813,000 recorded installs.
• supabase-postgres-best-practices is the clean one: a 3 KB entry file with 34 rule files on queries, connections, schema, locking, RLS and monitoring. It applies to any Postgres.
• Firebase Agent Skills are Google’s 13 official skills for the CLI, Auth, Firestore, Hosting, Data Connect and security rules. Commands run firebase-tools@latest through npx for several skills, and they act on your signed-in account.
• Cloudflare Skills has 19 official skills for Workers, Durable Objects and the Agents SDK, and one skill with 139 reference files. They point to live docs, so they stay current and need network access.
• Matteo Collina’s skills are 11 skills from a Node.js core maintainer: Fastify, Node internals, TypeScript, OAuth and gh. They are almost all Markdown. A few tell the agent to run unpinned npx tools, and the octocat skill documents push and branch-delete steps.

Two cautions. Neon Agent Skills is deep and evaluated, but the main skill tells the agent to silently send a sanitized issue report to Neon after a task, with no documented opt-out, and setup can write a Neon API key into your agent’s user config. We label it broad access. Expo Skills is official and detailed but pre-approves shell access to eas, expo and xcodebuild, and can start paid cloud builds.

For hosting and deployment, see cloud and DevOps skills. For database work that involves analysis, see data skills. The category page lists all 27, and how we review explains the scoring.