supabase.

supabase

Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, declarative schemas, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector); debugging and troubleshooting errors or unexpected behavior on Supabase projects (HTTP errors, Postgres errors, RLS surprises, permission denied, schema cache issues, timeouts, Edge Function crashes, Realtime drops, Storage failures) and reading or querying logs (Logs Explorer, ClickHouse).

supabase-postgres-best-practices

Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill BEFORE writing or changing anything that lives in a Postgres database: creating or altering tables and columns (including choosing column types), schema design, migrations and declarative schema files, RLS policies and the tests that verify them, indexes, triggers, database functions, queues and scheduled jobs (pg_cron, pgmq), vector/semantic search (pgvector), and restoring dumps (pg_restore) or importing data. Also load it when diagnosing slow queries, high CPU, timeouts, EXPLAIN plans, connection exhaustion, locking, bloat, or rows visible to the wrong user or tenant. This is not just a performance guide — schema, migration, security, and SQL authoring tasks need these rules too, even for a one-column change or a single query.

effect

|

test-audit

|

docs-eval-planning

Plan a documentation eval for supabase/evals, where a docs guide is the subject under test. Use when asked to write, add, or design an eval for a Supabase docs guide, when a ticket asks for a deterministic eval on a page, or when deciding what a guide-under-test eval should check. Produces a plan, not files. Not for debugging a scorer, running an eval, or writing example solutions.

shadcn

Manages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI. Provides project context, component docs, and usage examples. Applies when working with shadcn/ui, component registries, presets, --preset codes, or any project with a components.json file. Also triggers for "shadcn init", "create an app with --preset", or "switch to --preset".

react-vite-best-practices

React and Vite performance optimization guidelines. Use when writing, reviewing, or optimizing React components built with Vite. Triggers on tasks involving Vite configuration, build optimization, code splitting, lazy loading, HMR, bundle size, or React performance.

vercel-react-best-practices

React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.

create-supabase-middleware

Use when creating a new middleware for `@supabase/middleware` — either a built-in inside the middleware repo itself, or a standalone package that anyone can publish. Trigger when the user asks to write, scaffold, or add a middleware; describes a per-request cross-cutting concern they want to reuse ("I want to rate limit", "add request logging", "check an API key on every request"); calls `defineMiddleware`; or adds a new directory under `src/middleware/`. Also trigger when a plan proposes a new middleware, before any file is written.

supabase-middleware

Use when writing or modifying a Web Fetch handler that composes cross-cutting concerns with `@supabase/middleware` — CORS, feature flags, auth, rate limiting, logging — on Deno, Supabase Edge Functions, Cloudflare Workers, Bun, or Node. Trigger **before** writing or editing any file that imports from `@supabase/middleware` or a subpath (`/cors`, `/feature-flag`); calls `pipeline`, `defineMiddleware`, `getEnv`, `runtimeName`, or `seedContext`; or annotates a handler with `satisfies FetchHandler`. Also trigger during planning — if a plan mentions any of the above, load this skill before drafting code. Also trigger when porting middleware idioms that do not apply here: `app.use()` registries, `next()` chains, Express/Koa/Hono middleware being translated, or hand-rolled `(req) => wrapper(wrapper(handler))` nesting.

supabase

Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector).

pg-security-release-analysis

Generate a CVE catalog + Supabase impact analysis for a PostgreSQL security release. Use when reviewing a new upstream PG quarterly security release to decide what to ship and how to communicate. Inputs are the version ranges (e.g. REL_15_14..REL_15_18 + REL_17_6..REL_17_10); output is a draft catalog markdown ready to post on the breaking-change-analysis Linear ticket.

capability-matrix

Helps maintain the Supabase SDK capability matrix in packages/capability-matrix/capabilities/*.yaml and specs/ — naming a new feature ID, picking or creating a group, checking for duplicate or semantically-overlapping capabilities, spotting naming drift within a group, suggesting when a spec file is warranted, reviewing a spec for normative voice and precision, and noting platform-specific behavior. Use whenever a capability YAML or spec file is being added or edited, before opening a PR that touches capabilities/, or when asked to review/audit the matrix, check for duplicates, or suggest groupings. This is an advisory pass, not a gate — it complements `bun run validate`, it doesn't replace it.

supabase-server

Use when planning or writing server-side code that uses `@supabase/server` — Edge Functions, Hono apps, webhook handlers, or any backend that creates Supabase clients or validates inbound auth. Trigger **before** writing or modifying any file that imports from `@supabase/server` (or sub-paths like `@supabase/server/core`); calls `withSupabase`, `createSupabaseContext`, `createAdminClient`, `createContextClient`, `verifyAuth`, `verifyCredentials`, or `extractCredentials`; configures an `auth:` mode (`'none'` | `'publishable'` | `'secret'` | `'user'`, or keyed variants like `'secret:*'`); or lives under `supabase/functions/` and authenticates an inbound request. Also trigger during planning — if a plan mentions any of the above, load the skill before drafting code; do not extrapolate `auth:` values or auth modes from neighboring functions. Also trigger when you see legacy patterns to migrate to this package — `Deno.serve`, `createClient(Deno.env.get('SUPABASE_URL'))`, imports from `esm.sh/@supabase` or `deno.land/std`, usage of `SUPABASE_ANON_KEY` / `SUPABASE_SERVICE_ROLE_KEY`, or the deprecated `allow:` config option / removed `'always'` / `'public'` mode values / removed `authType` field.

new-lint

Create a new splinter lint — a SQL view that checks for a database anti-pattern. Use this skill when the user asks to add a lint, create a new check, implement a linting rule, or extend splinter with a new detection.

api-types

Maintain Supabase API types. Use when changing generated API type declarations, OpenAPI schemas, or investigating API type deployment drift.

ask-the-docs

>-

clickhouse-logs-queries

>-

code-review

Review repository changes for correctness, type boundaries, structural quality, and meaningful test coverage. Use for read-only code or PR assessments and development-task readiness checks.

copywriting

Write or audit UI copy (buttons, labels, empty states, error messages, tooltips, form text) anywhere in the monorepo. Load it before shipping or reviewing any user-facing text — including when copy is incidental to the task, like a new feature that adds buttons, toasts, dialogs, or validation messages.

dev-toolbar-review

Safety rules for the dev toolbar, PostHog client, and feature flags. Use

edit-the-docs

>-

explorer

Build and modify Studio Explorer surfaces, including notebooks, chats, SQL snippets, query cells, and their shared toolbar patterns.

pm-the-docs

>-

react-hook-form

Correct React Hook Form usage anywhere in the monorepo — data flow, subscriptions,

review-the-docs

>-

safe-sql-execution

>-

studio-e2e-tests

Write and run Playwright E2E tests for Supabase Studio (e2e/studio).

studio-error-handling

Error display and troubleshooting pattern for Supabase Studio. Use when

studio-mock-api-tests

Component tests for Supabase Studio that mock API requests at the

studio-queries

React Query conventions for data fetching in Supabase Studio. Use when

studio-shortcuts

Keyboard shortcut conventions for Supabase Studio. Use when adding a

studio-testing

Testing strategy for Supabase Studio. Use when selecting, writing,

studio-ui-patterns

Design system UI patterns for Supabase Studio. Use when building or updating

telemetry-standards

PostHog event tracking standards for Supabase Studio. Use when adding

test-the-docs

>-

vercel-composition-patterns

React composition patterns that scale. Use when refactoring components with

vitest

>-

write-the-docs

>-

implement-capability

Use when implementing a capability-matrix feature in the Supabase C# SDK — given a feature card (area, group, name, description, key such as auth.oauth_admin.delete_client, status, note), a bare capability key, or a request to close a parity gap with supabase-js ("implement X", "add support for the Y endpoint", "finish the partially implemented Z"). Takes one or several features; several are dispatched to parallel agents in separate worktrees. Researches the contract, gets the public API approved, drives it test-first to 100% coverage and zero surviving mutants on changed lines, passes the quality gate, and opens a draft PR.

sdk-quality-gate

Use before declaring any Supabase C# SDK change done or opening a PR, and as the Verify step of every flow. Runs the committed scripts/quality-gate/gate.sh script — the mechanized gauntlet (build/analyzers with a warning baseline, format on changed files, tests, a line-coverage baseline and E2E/acceptance tests, plus public-API diff and vulnerability-scan signals) — and reports its verdict. This is the deterministic "is it done" check; do not report a change as done without a PASS.

supabase-flutter-auth-setup

>-

supabase-flutter-idioms

>-

supabase-flutter-migrate-v3

>-

supabase-flutter-realtime

>-

supabase-idioms

>-

supabase-migrate-v3

>-

supabase-realtime

>-

supabase-test-testing

>-

supabase-typegen-generate

>-

auditing-tool-currency

Guides auditing the repository's externally sourced, version-pinned tooling against canonical origins - the GitHub Actions pins, the Go tool module under tools/go, the npm tool module under tools/node, the pinned Supabase CLI and the Go consumer floor. Use when asked which tools could be upgraded, whether pins are stale or to prepare an upgrade report or plan. Audit and report only: applying a bump is the changing-build-and-continuous-integration skill's territory.

changing-build-and-continuous-integration

Guides changes to this repository's build, module and CI machinery rather than the SDK's own code. Use when touching any go.mod, the go.work workspace, the scripts folder, GitHub Actions workflows, the pinned tool modules under tools or the spell-check configuration - including adding a new module, taking on a new dependency or bumping a Go or tool version. Covers workspace wiring for unpublished sibling modules, the published Go version floor versus the CI toolchain, digest pinning, the first-party-actions-only policy and the rule that CI jobs run the same scripts developers run locally.

designing-internal-boundaries

Guides the design of internal type contracts in respect of immutability and encapsulation. Enhances codebase maintainability by separating concerns in a manner that is compiler-enforced, both for internal state as well as immutable values returned to callers alike. Use when creating or reworking types, when adding machinery (e.g. parsing, caching, transport, crypto), when naming or splitting an internal package, when writing constructors or defensive copies and when deciding whether a test is external or in-package.

designing-public-interfaces

Guides design of this SDK's public API surface. Use when adding, renaming, removing or reshaping any exported identifier in any module published as end-user, consumer-facing interface - whether that module be existing or new to the published surface area. Includes functional options, domain client accessors, error model, sentinel errors, error struct types, exported fields, the accessor pattern, constructor signatures and naming policy.

recording-decisions

Guides when a development decision earns a decisions.md entry and how entries are proposed and written. Use when a design choice is made, changed or reverted during any task. Never write decisions.md unprompted - a candidate entry is proposed in chat through the three-part falsification test (maintainer question, answer-from-source attempt, why the answer fails) and only a commissioned entry is written. Covers the false-trigger list and the What/Why authoring rules.

writing-changelogs

Guides the writing and editing of changelog entries in the per-module CHANGELOG.md files. Use when a user-facing change needs an entry, when drafting or reshaping an Unreleased section, or when reviewing entries at release time. Covers the type headings, the entry shape and the succinctness bar - what an entry says and what it leaves to the docs.

writing-commentary

Guides the content and style of all comments - Go doc comments on exported or internal identifiers, package overviews in doc.go, inline comments and comments in scripts, workflows, SQL and configuration files. Use when writing, editing or reviewing any comment on any surface, including comments authored in passing while implementing something else. Covers audience focus (API consumer versus codebase maintainer), contract-first phrasing and where rationale, history and cross-component notes belong instead.

writing-examples

Guides the creation, update, merging and deletion of examples - the runnable Example functions that render on pkg.go.dev, the code snippets inside doc comments and the example programs under examples/. Use when adding an example, reworking one or deciding whether an existing example is replaced, upgraded, folded into a sibling or removed outright. Covers the removal test and when an example earns its place.

link-workspace-packages

'Link workspace packages in monorepos (npm, yarn, pnpm, bun). USE WHEN: (1) you just created or generated new packages and need to wire up their dependencies, (2) user imports from a sibling package and needs to add it as a dependency, (3) you get resolution errors for workspace packages (@org/*) like "cannot find module", "failed to resolve import", "TS2307", or "cannot resolve". DO NOT patch around with tsconfig paths or manual package.json edits - use the package manager''s workspace commands to fix actual linking.'

nx-generate

Generate code using nx generators. INVOKE IMMEDIATELY when user mentions scaffolding, setup, structure, creating apps/libs, or setting up project structure. Trigger words - scaffold, setup, create a ... app, create a ... lib, project structure, generate, add a new project. ALWAYS use this BEFORE calling nx_docs or exploring - this skill handles discovery internally.

nx-import

Import, merge, or combine repositories into an Nx workspace using nx import. USE WHEN the user asks to adopt Nx across repos, move projects into a monorepo, or bring code/history from another repository.

nx-plugins

Find and add Nx plugins. USE WHEN user wants to discover available plugins, install a new plugin, or add support for a specific framework or technology to the workspace.

nx-run-tasks

Helps with running tasks in an Nx workspace. USE WHEN the user wants to execute build, test, lint, serve, or run any other tasks defined in the workspace.

nx-workspace

"Explore and understand Nx workspaces. USE WHEN answering questions about the workspace, projects, or tasks. ALSO USE WHEN an nx command fails or you need to check available targets/configuration before running a task. EXAMPLES: 'What projects are in this workspace?', 'How is project X configured?', 'What depends on library Y?', 'What targets can I run?', 'Cannot find configuration for task', 'debug nx task failure'."

swift-api-design-guidelines

>

swift-docc

>

writing-migration-guides

>