skills.rest
Lynricsy
LynricsyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

supabase

Builds and audits Supabase applications covering Auth, RLS, Storage, Realtime, and Edge Functions.

22|Updated Sep 10, 2026
Search Tags:#authentication#migrations#supabase#row level security#edge functions#realtime#postgres
One-click install
npx skills add https://github.com/Lynricsy/HyperSkills --skill supabase-lynricsy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supabase
Source: https://github.com/Lynricsy/HyperSkills/tree/main/skills/supabase
Command: npx skills add https://github.com/Lynricsy/HyperSkills --skill supabase-lynricsy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @supabase/supabase-js, @supabase/ssr, @supabase/server, and includes references (resource) components.

What problem does it solve? Supabase projects fail in subtle ways: RLS policies that silently return empty results, sessions that never reach the server, Edge Functions that fail before the handler runs, and migrations that drop changes made in the dashboard. This Skill encodes the security rules, debugging workflows, and CLI procedures needed to build, review, and audit Supabase applications correctly. ## Core Features & Use Cases - Authorization and RLS done right: Write policies for the real access model (ownership, membership, tenancy), distinguish grant failures (42501) from policy failures (empty 200), and avoid bypass traps like SECURITY DEFINER functions in public and views without security_invoker. - Auth and session wiring: Choose between getClaims, getUser, and getSession, build per-request server clients with the getAll/setAll cookie adapter, and diagnose where a session goes missing in SSR frameworks. - Storage, Realtime, and Edge Functions: Configure private-bucket signed URLs, private Realtime channels with RLS on realtime.messages, and Edge Functions with correct verify_jwt, CORS, and secret handling. - CLI and migration workflow: Run declarative versus imperative schema workflows, read generated diffs for blind spots, deploy safely with db push --dry-run, and audit what an outsider can reach using only the publishable key. - Use Case: Your RLS policies return no data through the client SDK but work in the SQL editor. The Skill walks you through proving whether the session reached Postgres, checking the cookie adapter, and fixing the per-request server client instead of reaching for the secret key. ## Quick Start Ask the agent to review your Supabase project's RLS policies and server client setup, or to debug why authenticated queries return empty results while the SQL editor succeeds.

Frequently Asked Questions about supabase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Why do my Supabase RLS policies return no rows when the same query works in the SQL editor?▼

The SQL editor runs as the postgres role with BYPASSRLS, so it proves nothing about anon or authenticated access. Usually auth.uid() is null because no session reached Postgres; check the cookie adapter, the refresh path, and whether the server client is built per request.

How do I debug an empty result from the Supabase client?▼

First separate the failure shapes: a 42501 error means a missing GRANT, while a 200 with an empty array means RLS matched nothing. Run select auth.uid() through the same client or curl the REST endpoint with and without a Bearer token to see whether a session arrived.

What is the difference between getClaims, getUser, and getSession in Supabase?▼

getClaims verifies the JWT locally and is the right choice for protecting pages and data. getUser makes a network call for a fresh user record, and getSession reads storage without revalidation, so its user object must never drive authorization decisions.

Why does my Supabase Edge Function fail from the browser but work with curl?▼

The function is not answering the CORS preflight, so the browser blocks it before your handler runs and the logs stay empty. Use the withSupabase wrapper, which handles OPTIONS, or return explicit CORS headers covering authorization, apikey, x-client-info, and content-type.

Can I use the Supabase service_role key to fix an RLS policy that is not working?▼

No. The secret or service_role key has BYPASSRLS and disables row-level authorization entirely rather than repairing the policy. It must never reach a browser, mobile bundle, or log; fix the grant, policy, or session transport instead.

Why does supabase db diff report no schema changes after I edited a table in Studio?▼

In a declarative project, db diff compares the files in supabase/schemas against the migrations and never reads the live database. Changes made in Studio or the SQL editor are invisible to it and are silently dropped on the next db reset; edit the schema file instead.

Related Skills

Explore More Software Engineering Skills→
Seva-EatsSeva-Eats

supabase-postgres-best-practices

Review and rewrite Postgres queries, schemas, and RLS policies for Supabase.

Official
Advanced
robritacca-dotcomrobritacca-dotcom
1

ship

Commits verified work, merges to main, pushes, and confirms the deployed site renders.

Community
Advanced
globalmsqglobalmsq

moai-platform-supabase

Automate Supabase backend setup with Postgres 16, pgvector, RLS, and Edge Functions.

Official
Advanced
dudqks0319-cpududqks0319-cpu

supabase-node

Implements Express or Hono APIs with Supabase Auth and Drizzle ORM.

Community
Advanced