Supabase Claude skill review: Postgres Best Practices verdict, safety and alternatives
Supabase Postgres Best Practices is Supabase's Postgres rulebook skill for Claude and other agents. Our verdict is Conditional, 66/100, with safety grade A: cheap and sound, but one RLS example breaks policies.
- Verdict
- Conditional
- Score
- 66/100
- Confidence
- Moderate
- Safety grade
- A
- Best for
- Agents writing Postgres schema, indexes and queries that need compact wrong-vs-right SQL
- Poor fit
- Production RLS copied verbatim from the SECURITY DEFINER helper example
- Reviewed version
- SKILL.md 1.1.1 · repo tag v0.1.9 (commit 544bfc5)
- Review date
- 2026-09-30
- Works in verified
- Claude Code · Claude Sonnet 4.6 (Tessl eval)
- Works in claimed
- Codex · OpenCode · skills-CLI agents
- Status
- checked 2026-10-21, no change to the skill folder; fix PRs #409 and #314 still open
Get the skill: supabase-postgres-best-practices folder on GitHub · SKILL.md at the reviewed commit · skills.sh listing
What Supabase skills are available for Claude Code?
Supabase publishes two Agent Skills for Claude Code in supabase/agent-skills. The supabase skill covers all Supabase products and client libraries. This review covers supabase-postgres-best-practices, a Postgres rulebook with 31 wrong-vs-right SQL reference files.
Supabase is a Postgres development platform. Both skills are SKILL.md packages an agent loads on demand; our guide explains what Agent Skills are.
| Skill | Covers | Our verdict |
|---|---|---|
supabase |
Supabase products, client libraries, auth issues, CLI, schema management, debugging | Not evaluated |
supabase-postgres-best-practices |
Postgres design, migrations, security and performance | Conditional, 66/100 |
The Postgres skill sorts its rules into 8 categories by priority, per Supabase's January 2026 launch post:
- Query Performance (Critical)
- Connection Management (Critical)
- Security and RLS (Critical)
- Schema Design (High)
- Concurrency and Locking (Medium-High)
- Data Access Patterns (Medium)
- Monitoring and Diagnostics (Low-Medium)
- Advanced Features (Low)
| Fact | Value |
|---|---|
| Publisher | Supabase |
| Path | skills/supabase-postgres-best-practices in supabase/agent-skills |
| Licence | MIT |
| Files | 36: SKILL.md (3,231 bytes), 34 reference files and a changelog |
| Version fields | 1.1.1 (SKILL.md) · 1.6.0 (CHANGELOG) · v0.1.9 (repo tag) |
| Reviewed commit | 544bfc5 (2026-09-28) |
| Installs | 424.8K on skills.sh (2026-09-30), of 727.5K for the repo |
| Exact copies | 1,296 SKILL.md copies on GitHub |
| Stars and forks | 2,668 and 214 at review; 2,894 and 266 on 2026-10-21 |
The launch post counted 30 rules in January. The skill's description targets Postgres running anywhere, not only Supabase (publisher claim).
Is the Supabase Postgres skill worth installing?
Yes, the Supabase Postgres skill is worth installing when you review its security SQL: 66/100, Conditional, Moderate confidence. Tessl measured 95% impact on Sonnet 4.6 for about 808 instruction tokens. Its RLS helper example breaks policy evaluation.
A light entry file loads 31 focused rule files only when needed. Tessl, a third-party skill registry, ran the eval. The weak spot is the Row Level Security (RLS) material. RLS is the Postgres feature that filters rows per user. The SECURITY DEFINER helper example revokes EXECUTE from the authenticated role (#390, #499). Two fix PRs and a 13-item correctness report remain open.
| Parameter | Score |
|---|---|
| Effectiveness | 74 |
| Reliability | 55 |
| Safety | 70 |
| Efficiency | 88 |
| Compatibility | 72 |
| Maintainability | 48 |
| Setup friction | 92 |
| RLS example safety | 45 |
| Technical accuracy of reference SQL | 62 |
| Activation and discoverability | 62 |
| Fix acceptance | 40 |
| Cost of adoption | 90 |
| Instruction weight vs value | 82 |
The worst failure pulls the score down: an RLS example that breaks policy evaluation in production. For other picks, see the top-rated agent skills by verdict.
How many tokens does the Supabase Postgres skill use?
The Supabase Postgres skill's SKILL.md is about 808 tokens, and rule files load only on demand. One migration with indexes and RLS is estimated at 3,500 input tokens. With the skill loaded, our estimate is 5,308.
| What | Tokens |
|---|---|
| SKILL.md, loaded each time the skill runs | 808 (3,231 bytes) |
| Linked references | 1,062 |
| Whole folder | 1,870 |
| All references | about 53 KB of Markdown, read selectively |
| One migration with indexes and RLS, our estimate | 3,500 input, 1,500 output |
| Same task with the skill loaded, our estimate | 5,308 input, 1,500 output |
Our estimate assumes 10 uses a week. The hidden cost is review time: someone must correct the RLS helper by hand.
Is the Supabase Postgres skill safe to install?
Yes, the Supabase Postgres skill is safe to install, with safety grade A. It is Markdown only, with no scripts, hooks, network calls or credentials. The risk is copied SQL, not the files.
Our review of the folder at commit 544bfc5 found:
- No scripts, hooks, MCP configs or agent manifests.
- No network or environment-variable indicators.
- Reference links point to postgresql.org and supabase.com docs.
- All three skills.sh audits pass: Gen Agent Trust Hub, Socket and Snyk.
- Two reference links return 404 (#493); fix PR #517 is still open.
The safety score is 70, not higher. The RLS example fails closed and denies access, but it remains a security defect. Our guide to vetting a skill before you install it explains the grade.
What does the community report about the Supabase Postgres skill?
The community reports about the Supabase Postgres skill lean negative on accuracy. Issues #390 and #499 hit 42501 errors from its RLS helper example. Issue #83 lists 13 correctness problems, open since 2026-05.
| Source | Date | Finding | Sentiment |
|---|---|---|---|
| Tessl evals | 2026-08 | 95% impact, 84% quality over 3 scenarios on Sonnet 4.6 | Positive |
| Tessl quality | 2026-09 | Description 100%, content 68% | Neutral |
| Issue #83 | 2026-05 | CodeRabbit found 13 correctness issues | Negative |
| Issue #390 | 2026-08 | RLS helper revoke caused HTTP 403 and 42501 | Negative |
| Issue #499 | 2026-09 | Same helper re-reported | Negative |
| PR #409 | 2026-08 | RLS helper fix unmerged | Negative |
| PR #314 | 2026-08 | Second privilege fix, tested on PostgreSQL 17, unmerged | Negative |
| Issue #367 | 2026-08 | PG 18 skip scan ignored; closed not planned | Negative |
| Issue #118 | 2026-07 | Vacuum reference overstates plain VACUUM | Negative |
| Issue #493 | 2026-08 | Two reference links return 404 | Negative |
| PR #517 | 2026-09 | Dead-link fix still open | Negative |
| Issue #100 | 2026-06 | References never loaded on scaffolding prompts | Negative |
| PR #194 | 2026-07 | Description rewrite merged | Positive |
| Issue #146 | 2026-07 | Security section lacks write-side RLS guidance | Negative |
| PR #58 | 2026-04 | Broken link fixed the same day | Positive |
These are the 15 dated reports we weighed: 3 positive, 1 neutral and 11 negative, with 5 rated strong. Evidence confidence is Moderate.
What are the Supabase Postgres skill's known failures?
The Supabase Postgres skill has three main failures at commit 544bfc5. Its SECURITY DEFINER helper example breaks RLS policies (#390, #499). Superuser-only snippets fail on Supabase, and the composite-index rule ignores PostgreSQL 18 skip scan.
The status of each failure on 2026-10-21:
- The RLS helper revokes EXECUTE from authenticated, so policies fail with 42501 or HTTP 403. Issues #390 and #499 are open; fix PRs #409 and #314 are unmerged.
- ALTER SYSTEM and SET deadlock_timeout need superuser rights and fail on Supabase managed Postgres. Issue #83 lists 13 problems and is still open.
- The composite-index rule ignores PostgreSQL 18 btree skip scan. Issue #367 closed as not planned.
- Two reference links are dead (#493). PR #517 is still open.
- References did not load on scaffolding prompts (#100). PR #194 rewrote the description, a partial fix.
The fifth failure matches a common pattern; see when a skill never loads.
Should you use the Supabase skill or the Supabase MCP server?
Use both: the Supabase MCP server gives your agent a live connection to your project. The Supabase Postgres skill only supplies SQL guidance, with no connection or credentials. Supabase's plugin installs both in one step.
Supabase's AI Tools doc calls MCP "a live connection between your agent and your actual Supabase project". Skills need no live connection. The Supabase Plugin for AI Coding Agents bundles both.
| Aspect | Postgres skill | supabase skill |
MCP server |
|---|---|---|---|
| Gives the agent | SQL rules, wrong vs right | Supabase product guidance | Live project access |
| Live connection | No | No | Yes |
| Credentials | None | None | Supabase login or token |
| Install | --skill supabase-postgres-best-practices |
--skill supabase |
claude mcp add (below) |
| Our verdict | Conditional, 66 | Not evaluated | Not a skill (out of scope) |
Add the hosted server to Claude Code with this command from Supabase's MCP doc:
claude mcp add --scope project --transport http supabase "https://mcp.supabase.com/mcp"The doc offers ?read_only=true and ?project_ref= to scope access. It warns of prompt injection (vendor-stated). Supabase's blog eval of its other skill, supabase, measured that skill with and without MCP. Those numbers do not apply here. Read skills vs MCP servers explained for the general case.
Which agents does the Supabase Postgres skill work with?
The Supabase Postgres skill is verified in Claude Code and on Claude Sonnet 4.6 through a Tessl eval. Codex and OpenCode are claimed. Supabase's README names 18+ agents, but documents no runs.
| Agent | Status | Source |
|---|---|---|
| Claude Code | Verified | User reports #390, #100 |
| Claude Sonnet 4.6 | Verified | Tessl eval |
| Codex | Claimed | Publisher |
| OpenCode | Claimed | Publisher |
Agents using npx skills |
Claimed | Publisher |
| 18+ agents incl. GitHub Copilot, Cursor, Cline | Claimed by Supabase | README |
For other picks, see the best Claude Code skills by verdict.
How do you install the Supabase Postgres skill?
Install the Supabase Postgres skill with npx skills add supabase/agent-skills --skill supabase-postgres-best-practices. In Claude Code, the supabase/agent-skills plugin marketplace route works too. No credentials, MCP server or scripts are needed for this skill.
- Run the skills CLI in your project:
npx skills add supabase/agent-skills --skill supabase-postgres-best-practices- Add
--globalto install it for all projects. - Or, in Claude Code, add the marketplace:
/plugin marketplace add supabase/agent-skills. - Then install the plugin:
/plugin install postgres-best-practices@supabase-agent-skills. - Update later with
npx skills update supabase-postgres-best-practices.
Cursor and Codex use the same npx command; we have not confirmed those installs. Setup friction scores 92. The Claude Code skills setup guide covers scopes and folders. For the Claude app, read how to add skills to Claude.
How do you use the Supabase Postgres skill?
Use the Supabase Postgres skill by asking for schema, index, migration or RLS work. Review any SECURITY DEFINER helper it writes. Keep EXECUTE for the roles that evaluate the policy, then test as the authenticated role.
The description triggers on these tasks:
- Schema design and migrations
- RLS policies
- Indexes and slow queries
- Triggers, pgvector and pg_cron
| Task | Label | Frequency |
|---|---|---|
| Writing RLS policies and SECURITY DEFINER helpers | Primary | Weekly |
| Choosing and reviewing indexes | Primary | Weekly |
| Designing schemas and migrations for a new project | Primary | Per project |
| Diagnosing bloat, vacuum and slow queries | Secondary | Monthly |
| Configuring connection pooling and timeouts | Secondary | Occasional |
| Building queues with SKIP LOCKED | Claimed only | Occasional |
Test it yourself:
- Ask the agent to add a team-scoped RLS policy.
- Have it use a private SECURITY DEFINER helper.
- Run a query as the authenticated role.
- Check the result for a 42501 error.
What are the alternatives to the Supabase Postgres skill?
The closest alternative to the Supabase Postgres skill is Neon's neon-postgres skill: Recommended, 76/100, with safety grade C. Supabase's own supabase skill covers all Supabase products. It has no verdict from us yet.
| Skill | Publisher | Verdict | Note |
|---|---|---|---|
| neon-postgres (Using Neon) | Neon | Recommended, 76, safety C | Neon-specific pooling, branching, migrations |
| supabase | Supabase | Not evaluated | All Supabase products |
| Supabase Implementation Expert | zacharyr0th (community) | Not evaluated | Listed on mcpmarket; 1 star |
The third row is a community skill, not an official one. Read our Using Neon skill verdict before you switch.
Common questions
Is the Supabase Postgres skill free?
Yes. It is MIT-licensed and needs no account.
Is it only for Supabase databases?
No. Its description targets Postgres anywhere (publisher claim), though some superuser snippets assume self-managed Postgres (#83).
Does it need the Supabase CLI?
No. It ships no scripts or CLI calls.
Is it safe to use for RLS?
Yes, but only after you fix the helper's EXECUTE grant. Then test as the authenticated role (#390).
Where is the Supabase Postgres skill on GitHub?
It sits in skills/supabase-postgres-best-practices in supabase/agent-skills. Our guide shows how a SKILL.md file works.
Can Claude Code work with Supabase?
Yes. The Supabase MCP server gives live access, and Supabase's two skills give guidance.