skills.rest
amoai-tech
amoai-techCOMMUNITY
Explore all skills by this author →
GitHub

supabase

Implements and verifies Supabase schema, RLS, auth, migrations, Edge Functions, Realtime, and Storage changes.

1|Updated Sep 15, 2026
Search Tags:#migrations#rls#supabase#edge functions#realtime#storage#postgres
One-click install
npx skills add https://github.com/amoai-tech/mdeai --skill supabase-amoai-tech
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supabase
Source: https://github.com/amoai-tech/mdeai/tree/main/.claude/skills/supabase
Command: npx skills add https://github.com/amoai-tech/mdeai --skill supabase-amoai-tech

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Supabase work in this repository spans schema migrations, RLS policies, auth flows, Edge Functions, Realtime channels, and Storage buckets, and mistakes in any of these (user-editable metadata authorization, missing SELECT policies, exposed service-role keys) create silent security holes. This Skill routes all Supabase tasks through current official guidance plus MDE-specific invariants so changes are verified against live behavior rather than remembered conventions. ## Core Features & Use Cases - Schema, RLS, and Auth ownership: Designs migrations, RLS policies, and auth flows with rules like never authorizing from user_metadata, pairing UPDATE with SELECT policies, and keeping service-role keys server-side. - Edge Functions, Realtime, and Storage references: Ships complete guides for Deno.serve Edge Functions, broadcast-based Realtime with private channels, and Storage buckets with signed URLs and RLS. - Verification workflow: Requires proving authorized success and unauthorized denial, running advisors, and checking drift via scripts/verify-edge-inventory.sh. - Use Case: When adding an UPDATE policy to an org-owned bookings table, the Skill inspects the current schema, applies the (SELECT auth.uid()) pattern, and proves both the allowed update and the cross-tenant denied case. ## Quick Start Ask the agent to add an RLS policy or migration for a Supabase table and have it verify both the allowed and denied access paths.

Frequently Asked Questions about supabase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a secure RLS policy in Supabase?▼

Enable RLS on every exposed table and write policies matching the actual access model, using (SELECT auth.uid()) instead of auth.uid() for per-query caching. Every UPDATE or DELETE policy needs a paired SELECT policy, and authorization must read app_metadata, never user-editable user_metadata.

How do I deploy Supabase Edge Functions with Deno?▼

Write functions with the built-in Deno.serve handler, add a [functions.name] block to supabase/config.toml, then run supabase functions deploy. Webhooks and custom-auth endpoints need verify_jwt = false with in-handler signature or secret validation.

Should I use postgres_changes or broadcast for Supabase Realtime?▼

Use broadcast via database triggers for all new features; postgres_changes is single-threaded and does not scale. Configure channels with private: true, call supabase.realtime.setAuth() before subscribing, and add RLS policies on realtime.messages.

Why does my Supabase UPDATE silently affect zero rows?▼

Postgres RLS requires a SELECT policy before an UPDATE can see the row, so an UPDATE without a matching SELECT policy returns 0 rows with no error. Audit pg_policies to confirm every mutating policy has a corresponding SELECT.

Can I use user_metadata for authorization decisions in Supabase?▼

No, raw_user_meta_data is editable by the user through the client and appears in JWT claims, making it unsafe for authorization. Store roles in raw_app_meta_data via a server-side trigger and read auth.jwt() -> 'app_metadata' in policies.

How do I serve private files from Supabase Storage?▼

Create a private bucket with file size and MIME limits, then generate time-limited signed URLs with createSignedUrl, typically one hour expiry. Add RLS policies on storage.objects using storage.foldername(name) to scope access per user.

Related Skills

Explore More Software Engineering Skills→
danielsuguimotodanielsuguimoto

database

Inspect live database schema, run read-only queries, and execute Eloquent operations via REPL.

Community
Intermediate
Blaze-sports-IntelBlaze-sports-Intel

database-development

Design schemas, generate reversible migrations, and validate indexing and row-level security.

Official
Advanced
DojoCodingLabsDojoCodingLabs
4

backend-dev-guidelines

Guide Supabase backend development with TypeScript, RLS, and Edge Functions.

Official
Advanced
stars-endstars-end

context-database-schema

Manage PostgreSQL/Supabase schema migrations with Alembic and RLS policies.

Official
Advanced