Supabase Postgres Best Practices
Supabase Postgres Best Practices (supabase-postgres-best-practices) is a skill by Supabase that teaches coding agents Postgres rules for schema design, RLS policies, indexes and migrations.
Notes by Lior Pesoa · Updated · Works with Claude Code, Codex
Made by Supabase.
Source: github.com/supabase/agent-skills · MIT license. Everything below is my review: I tested it myself.
npx skills add supabase/agent-skills --skill supabase-postgres-best-practicesRaw for agents: /library/supabase-postgres-best-practices.md
Verdict
6/10
My scoreA safety net more than an upgrade. The agent already wrote a secure migration without it, and the skill added a few hardening details, not a better design.
Tested · v1.6.0
Pros
- Added hardening the plain run skipped: RLS forced even for the table owner, and helper functions moved to a schema the API doesn't expose.
- Made the streak trigger handle a batch of check-ins at once, which fits apps that sync offline changes.
- Covers far more than schemas: indexes, slow queries, locking, pg_cron and pgvector, all in one skill.
- Free and MIT licensed, and maintained by Supabase.
Cons
- On a typical migration the difference was small. Both runs enabled RLS on every table, locked down default grants and checked ownership the same way.
- The run without the skill made the better product call: it worked out the current streak in each habit's own timezone. The skill's version left that to the app.
- Cost about 15% more for the same task, because the agent reads the skill's rules first.
- Best for
- Anyone shipping on Supabase who wants a second check on schema and RLS before a migration goes live.
- Skip it if
- You review every migration yourself and already know Postgres security well.
The test
Same task, both runs
Write the Postgres schema migration for Streak, a habit-tracking iPhone app on Supabase: users' habits, daily check-ins, and current/longest streak per habit. Users must only ever see their own data. Put it in one file, migration.sql, in the current directory.
- 319 lines, 3 tables, 8 RLS policies
- RLS enabled on all tables, not forced
- Default Supabase grants revoked
- Ownership enforced with a combined foreign key
- Current streak computed per habit timezone in a view
- 268 lines, 3 tables, 8 RLS policies
- RLS enabled and forced on all tables
- Default Supabase grants revoked
- Helper functions in a private schema
- Streak trigger handles batches of check-ins
- Current streak left to the app to compare with local today
What I found
- Both migrations were secure: RLS on every table, policies using (select auth.uid()), grants locked down and ownership checked across tables.
- The skill's version added defense in depth: forced RLS and a private schema for helper functions.
- The version without the skill handled "current streak" better, using each habit's timezone, while the skill's version left that to the app.
- Neither run could execute the SQL: there was no Postgres server on the test machine, so both were checked by reading.
How I ran it: Claude Code 2.1.306 with Claude Opus, run headless twice with only Claude Code's built-in skills loaded (no user skills, plugins or MCP servers). The second run had supabase-postgres-best-practices installed in the project and its prompt started with "Use the supabase-postgres-best-practices skill."
Questions
Who made supabase-postgres-best-practices?
Supabase. It's published in github.com/supabase/agent-skills under the MIT license. This page is my review of it.
Does it only work with Supabase?
No. The rules are for Postgres running anywhere, though some examples use Supabase features.