supabase-postgres-best-practices skill

Supabase's Postgres performance and security rulebook: 34 rule files on queries, connections, schema, locking, RLS and monitoring, for any Postgres.

Our verdict Recommended

A compact, well-organized Postgres rulebook from a vendor that runs Postgres at scale; load it for any database change.

What the supabase-postgres-best-practices skill does

This skill is a prioritized rulebook that an agent consults before writing or changing anything that lives in a Postgres database. The entry file is only about 3 KB; it lists eight rule categories ordered by impact and tells the agent when to load them: writing SQL, designing schemas, adding indexes, reviewing slow queries, configuring connection pooling and working with Row-Level Security. Critical categories are query performance, connection management and security with RLS. Next come schema design (primary keys, data types, constraints, foreign-key indexes, lowercase identifiers, partitioning), concurrency and locking (short transactions, deadlock prevention, SKIP LOCKED, advisory locks), data access patterns (batch inserts, N+1, pagination, upserts), monitoring (EXPLAIN ANALYZE, pg_stat_statements, vacuum) and advanced features (full-text search, JSONB indexing).

The depth is in the 34 files under references/, each named with its category prefix, such as query-composite-indexes, conn-pooling, lock-deadlock-prevention, security-rls-performance and schema-partitioning, plus a contributing guide and rule template. The description says it applies to Postgres running anywhere, not only on Supabase. There are no scripts or evals, and no external accounts or tools are needed.

Good for

  • Reviewing schemas, indexes and queries written by an agent
  • Tuning connection pooling and locking behavior
  • Writing RLS policies that stay fast

Not for

  • Non-Postgres databases
  • Supabase product tasks like Auth or Edge Functions (use the supabase skill)

Depth 3/5

A short 3 KB entry file backed by 34 rule reference files, but no scripts, tests or evals.

Security review

No issues found

We scanned all 36 files in this skill folder and read every script. Nothing in it reaches beyond what the skill describes.

A markdown-only Postgres performance and schema best-practices skill (36 files of rules and references). It has no scripts, hooks, allowed-tools or network instructions.

What we checked

The skill folder (36 files) on Oct 29, 2026. We had every file and read every script.

NVIDIA SkillSpector static scan: 0 pattern hits. SkillSpector reported no hits. The one credential-looking line is an example create role app_user login password 'xxx' in a security-privileges reference.

A review, not a certification. Skills change after we check them — read the files before installing.

License

MIT — commercial use allowed.

Can it run unattended?

Not really. It is a reference rulebook consulted during interactive database work and contains no loop or verification procedure.

Alternatives

Neon Agent Skills

neondatabase/agent-skills

Neon's official skills for Lakebase Postgres and its Auth, Functions, Object Storage, AI Gateway and Realtime services, with branch-first workflows and evals.

With caveats Broad access Depth 4/5

Firebase Agent Skills

firebase/agent-skills

Google's 13 official Firebase skills: CLI and project setup, Auth, Firestore, Hosting, App Hosting, Data Connect, AI Logic and security rules.

Recommended Check first Depth 3/5

jezweb claude-skills

jezweb/claude-skills

A marketplace of Claude Code plugins for web builders: Cloudflare apps, design assets, frontend, dev tools, writing, Shopify and WordPress.

With caveats Broad access Depth 3/5

InsForge Agent Skills

InsForge/insforge-skills

Four skills for building on the InsForge backend-as-a-service: SDK integration, CLI project management, debugging and auth-provider integrations.

With caveats Broad access Depth 3/5

FAQ

What is supabase-postgres-best-practices?

It is a Supabase-maintained skill with 34 rule files for Postgres, covering query performance, connection management, RLS security, schema design, locking, data access patterns and monitoring. It works for Postgres running anywhere.

How do I install it?

Run npx skills add supabase/agent-skills --skill supabase-postgres-best-practices, or install the postgres-best-practices plugin from the Supabase marketplace in Claude Code.

Do I need Supabase to use it?

No. The description says it is for Postgres running anywhere, although some examples relate to Supabase features like RLS.

supabase-postgres-best-practices vs the supabase skill: which one?

Use the best-practices skill for generic Postgres design and performance. Use the supabase skill for Supabase products, the CLI and MCP, and Auth security rules. Many Supabase projects benefit from both.

Sources: GitHub repository; install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the published SKILL.md.