Neon Agent Skills
neondatabase/agent-skillsNeon's official skills for Lakebase Postgres and its Auth, Functions, Object Storage, AI Gateway and Realtime services, with branch-first workflows and evals.
With caveats
Broad access Depth 4/5
Supabase Agent Skills Claude skills
Supabase's official skills: a general Supabase skill for Auth, RLS, CLI and MCP, and a Postgres best-practices skill with 34 rule files.
Our verdict Recommended
Vendor-maintained, MIT-licensed and specific; the security rules are the main reason to install it.
What Supabase Agent Skills does
Supabase publishes two skills here. The first, supabase, is a 14 KB catch-all that loads for any Supabase task. It tells the agent not to trust training data, because the product changes often, and to check the Supabase changelog and docs first. It then lays out security rules agents commonly get wrong: never use user_metadata claims for authorization, never expose the service_role key to clients, write UPDATE policies with both USING and WITH CHECK, and avoid SECURITY DEFINER functions in the public schema. It also covers CLI quirks (version requirements, scoped access tokens versus the browser login), troubleshooting the Supabase MCP server, and how to make and commit schema changes, whether the project uses declarative schemas or hand-written migrations. A small feedback reference lets the agent file a GitHub issue about the skill, but only after asking you.
The second, supabase-postgres-best-practices, is a short entry file plus 34 rule references in eight categories, ordered by impact: query performance, connection management, security and RLS, schema design, locking, data access patterns, monitoring and advanced features. It applies to any Postgres, not just Supabase. Install with npx skills add supabase/agent-skills, or as Claude Code plugins from the repo's marketplace. There are no scripts or evals.
Good for
- Building on Supabase with an agent, especially Auth, RLS and migrations
- Reviewing a Postgres schema or queries for performance and security
- Keeping an agent from using outdated Supabase APIs
Not for
- Other backend platforms
- Production database changes without human review of any SQL the agent proposes
What's inside depth 3/5
Two skills (14 KB and 3 KB entry files) with 34 Postgres rule files and a feedback template, but no scripts, tests or evals.
- Skills
- 2
- Reference docs
- 37
- Scripts
- 0
- Tests / evals
- 0
- Templates
- 1
- Avg SKILL.md
- 8.6 KB
Counted from the repository file tree. How we score depth.
Dependencies and costs
- Supabase project
- Optional: Supabase CLI (v2.79+ for db query)
- Optional: Supabase MCP server (OAuth or a scoped personal access token)
Security review
Review before installingSupabase's official skills: a general Supabase skill (CLI, MCP, Auth, RLS, migrations) and a Postgres best-practices guide, as markdown with a plugin manifest and an .mcp.json for the hosted docs MCP server. The only scripts are release/test tooling. The skill tells the agent to read Supabase's changelog and docs at run time and to use the CLI or MCP server against your project with the credentials you provide.
Worth knowing
- Makes network requestsThe plugin registers Supabase's hosted MCP server (https://mcp.supabase.com/mcp?features=docs, OAuth or a scoped access token), and the supabase skill tells the agent to fetch supabase.com/changelog.md and docs pages and to curl-check the MCP URL when troubleshooting..mcp.json:5
- Relies on a CLI or package we could not reviewThe skill drives the Supabase CLI (db query/push, login, advisors) and the Supabase MCP server, neither of which is in the repo; it warns that
supabase logincreates a full-access token and recommends scoped personal access tokens.skills/supabase/SKILL.md:86
What we checked
The repository (61 files) on Oct 29, 2026. Not a full review: it relies on code outside the repository: Supabase CLI and the hosted Supabase MCP server (mcp.supabase.com).
NVIDIA SkillSpector static scan: 29 pattern hits (Privilege Escalation 11, Supply Chain 8, Agent Snooping 4, MCP Rug Pull 4, YARA Match 1, Excessive Agency 1). The 'info_stealer' YARA hit is the frontmatter description listing auth topics (cookies, getSession, RLS); 'access token' hits are advice to use scoped tokens; unpinned devDependencies and tar/vitest advisories are in the maintainer package.json, not used by the skills; the README 'npx skills' is the install command.
A review, not a certification. Skills change after we check them — read the files before installing.
License
MIT — commercial use allowed.
Can it run unattended?
Not really. These are reference and guardrail skills for interactive work; they include a verify-after-change rule and a stop-after-3-failures rule but no unattended loop.
Skills in this repository
| Skill | Installs |
|---|---|
| supabase-postgres-best-practices | 465K |
| supabase | 348K |
Linked skills have their own review.
Alternatives to Supabase Agent Skills
Firebase Agent Skills
firebase/agent-skillsGoogle's 13 official Firebase skills: CLI and project setup, Auth, Firestore, Hosting, App Hosting, Data Connect, AI Logic and security rules.
Recommended
Check first Depth 3/5
InsForge Agent Skills
InsForge/insforge-skillsFour skills for building on the InsForge backend-as-a-service: SDK integration, CLI project management, debugging and auth-provider integrations.
With caveats
Broad access Depth 3/5
jezweb claude-skills
jezweb/claude-skillsA marketplace of Claude Code plugins for web builders: Cloudflare apps, design assets, frontend, dev tools, writing, Shopify and WordPress.
With caveats
Broad access Depth 3/5
FAQ
What are the Supabase agent skills?
They are two skills from Supabase: supabase, a general skill for Database, Auth, Edge Functions, Realtime, Storage, the CLI and the MCP server, and supabase-postgres-best-practices, a set of Postgres performance and security rules that applies to any Postgres.
How do I install the Supabase skills?
Run npx skills add supabase/agent-skills, or add --skill supabase or --skill supabase-postgres-best-practices for one. For Claude Code, claude plugin marketplace add supabase/agent-skills and then claude plugin install supabase@supabase-agent-skills.
Do I need the Supabase MCP server?
No. The skill works from docs and the CLI, and it describes how to troubleshoot the MCP server when you use it, including OAuth and scoped personal access tokens.
Are the Supabase skills safe?
We found no hidden network calls or credential access. The skill fetches Supabase's changelog and docs, recommends scoped tokens, and asks before filing feedback issues.
Sources: GitHub repository (stars, license, file tree, last push Oct 2, 2026); install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the README and SKILL.md files as published.