Supabase Ships Agent Skills

An artificial intelligence coding agent can already write a database query, but Supabase says that same agent will often miss the rules that decide who is allowed to see each row. Supabase’s new Agent Skills are meant to hand the agent a playbook before it starts touching your database or authentication setup. (supabase.com) Supabase is a backend platform built around the Postgres database, and it bundles authentication, file storage, server-side functions, and instant application programming interfaces on top. That means one bad generated change can hit sign-in, permissions, and data access all at once instead of breaking only one script. (supabase.com) One of the hardest parts is Row Level Security, which is the database equivalent of a hotel keycard that opens only your room and not the whole building. Supabase says agents regularly generate code that works in a demo but ignores Row Level Security policies that production apps depend on. (supabase.com) Agent Skills are packaged folders with instructions, scripts, and reference files that an agent can discover and load when a task matches the description. Supabase’s docs say the goal is to give agents procedural knowledge and team-specific context on demand instead of hoping a one-line prompt covers every edge case. (supabase.com) Supabase formally introduced its Agent Skills on April 9, 2026, and described them as an open-source set of instructions for teaching coding agents how to build on Supabase correctly. The company framed the release around a simple failure mode: agents know Supabase exists, but they do not reliably use the platform the way its docs and security model expect. (supabase.com) The public repository already has a core Supabase skill whose description tells an agent to use it for any task involving Supabase. The same repository also includes a separate Postgres best practices skill, which shows that Supabase is splitting “how to use our platform” from “how to write safe database code” instead of stuffing both into one giant prompt. (github.com, supabase.com) Supabase is also building the rest of the plumbing around this idea. In a blog post published the week before, it launched “docs over Secure Shell,” a file-system style interface that lets agents search and read current Supabase docs with commands like list, find, and cat, which are the same commands agents already use in codebases. (supabase.com) That pairing matters because a coding agent usually fails in two boring ways: it forgets a platform rule, or it guesses from stale training data. Supabase’s answer is to give the agent both a reusable rulebook in Agent Skills and a live documentation source in supabase.sh so the model has fewer reasons to improvise. (supabase.com, supabase.com) For teams wiring artificial intelligence into sign-in flows, schema changes, and database migrations, this is less about making the model smarter than making it narrower. A narrower agent that knows Supabase’s command line interface patterns, schema conventions, and security checks is usually more useful than a general model that confidently invents the wrong policy. (supabase.com, supabase.com) Supabase had already been publishing copy-and-paste prompts for tools like Cursor and GitHub Copilot, but Agent Skills move that guidance into a reusable package that can travel with the project. The shift is from “paste this into chat” to “attach this operating manual,” which is a better fit for agents that plan, call tools, and edit files over many steps. (supabase.com, supabase.com)