What problem does it solve? Supabase APIs, CLI commands, and security conventions change frequently, and AI agents relying on stale training data produce broken migrations, insecure RLS policies, and deprecated auth patterns. This Skill grounds every Supabase task in current documentation, changelogs, and a security checklist. ## Core Features & Use Cases - Security checklist enforcement: Catches Supabase-specific traps like user_metadata in JWT authorization, views bypassing RLS, SECURITY DEFINER functions exposed in public schemas, and BOLA/IDOR vulnerabilities in policies. - Schema change workflow: Directs agents to iterate with execute_sql or supabase db query, run advisors, then commit clean migrations via supabase db pull instead of polluting migration history. - CLI and MCP guidance: Covers command discovery via --help, version-specific gotchas, and step-by-step MCP server connection troubleshooting. - Use Case: When adding a new table with row-level security in a Next.js app, the agent checks the changelog for breaking changes, writes policies using TO authenticated with ownership predicates, and verifies the result with a test query. ## Quick Start Ask the agent to create a Supabase migration that adds a posts table with RLS policies restricting access to each row's owner.
