supabase

Guides Supabase development tasks including schema changes, RLS policies, auth, and CLI workflows.

2|1|Updated Apr 17, 2025
One-click install
npx skills add https://github.com/abraham-yusuf/pernikahan-web --skill supabase-abraham-yusuf
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: supabase
Source: https://github.com/abraham-yusuf/pernikahan-web/tree/main/.agents/skills/supabase
Command: npx skills add https://github.com/abraham-yusuf/pernikahan-web --skill supabase-abraham-yusuf

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve? Working with Supabase involves frequent API changes, subtle security traps (RLS bypasses, unsafe JWT claims, exposed service keys), and CLI version differences that cause silent failures. This Skill provides verified guidance, security checklists, and correct workflows for any Supabase task. ## Core Features & Use Cases - Security-First Guidance: Enforces RLS on exposed schemas, prevents misuse of user_metadata in authorization, and flags dangerous patterns like security definer functions in public schemas. - Schema Change Workflow: Directs correct use of execute_sql, supabase db query, advisors, and migration generation without polluting migration history. - CLI and MCP Troubleshooting: Covers version-specific CLI gotchas, MCP server connectivity checks, and OAuth authentication steps. - Use Case: When adding a new table with user-specific data in a Next.js app, the Skill ensures you enable RLS, write correct SELECT/UPDATE policies, verify with a test query, and commit a clean migration. ## Quick Start Ask the agent to help you create a new Supabase table with row level security policies and generate the corresponding migration file.

Frequently Asked Questions about supabase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a Supabase migration file correctly?

Create migration files with supabase migration new <name>, never by inventing filenames manually. Iterate on schema changes using execute_sql or supabase db query first, then commit with supabase db pull <name> --local --yes after running advisors.

How do I write RLS policies in Supabase?

Enable RLS on every table in exposed schemas like public, then write policies matching your actual access model. Remember UPDATE requires a SELECT policy, and never use user_metadata claims for authorization since they are user-editable.

Why is my Supabase UPDATE returning 0 rows with RLS enabled?

In Postgres RLS, an UPDATE must first SELECT the row, so a missing SELECT policy causes updates to silently affect 0 rows with no error. Add a SELECT policy alongside your UPDATE policy to fix this.

Can I use the Supabase service_role key in Next.js frontend code?

No, never expose the service_role or secret key in public clients. Any NEXT_PUBLIC_ environment variable is sent to the browser, so use publishable keys for frontend code and keep service keys server-side only.

Why is the Supabase MCP server not connecting?

First check reachability with curl to https://mcp.supabase.com/mcp, where a 401 means the server is up. Then verify your .mcp.json configuration and complete the OAuth 2.1 authentication flow in your browser.

Do Supabase views respect row level security?

Views bypass RLS by default. In Postgres 15 and above, create views WITH (security_invoker = true); in older versions, revoke access from anon and authenticated roles or place views in an unexposed schema.