Complete Supabase platform documentation. Use when working with Supabase - covers authentication (email, OAuth, magic links, phone, SSO), database (PostgreSQL, RLS, migrations), storage (file uploads, CDN), edge functions, realtime subscriptions, AI/embeddings, cron jobs, queues, and platform management. Includes framework integrations (Next.js, React, SvelteKit, etc.).
Security Analysis
medium confidenceThis is an instruction-only documentation skill that contains a full copy of Supabase docs; its files and runtime instructions are consistent with that purpose and it does not request credentials or install code, but you should still review the packaged files because a pre-scan flagged a potential embedded base64 block and the bundle contains many command examples referencing tokens.
Name/description match the packaged contents: a large collection of Supabase docs covering auth, DB, storage, functions, realtime, AI, etc. The skill asks for no binaries, env vars, or installs — appropriate for a read-only documentation skill. The single small code file (navigation.references.ts) is plausibly navigation metadata for the docs.
SKILL.md limits the agent to reading files under references/ and explicitly warns agents NOT to auto-execute example commands; that keeps runtime scope narrow. However, the included documentation contains many example commands and snippets that reference API tokens, curl calls, and obtaining secrets (e.g., SUPABASE_ACCESS_TOKEN, sb_secret_...). Those are expected in documentation but are sensitive if executed or exfiltrated, so follow the explicit warning and do not auto-run snippets.
No install spec — instruction-only skill. Nothing is downloaded or written to disk by an installer, which is the lowest-risk installation model.
The skill declares no required environment variables, credentials, or config paths. The presence of many examples that mention obtaining tokens or using service_role keys is normal for documentation, but these are examples only and the skill itself does not request them.
always:false and no special privileges requested. The skill is user-invocable and may be invoked autonomously by the agent (platform default), but it does not request permanent system presence or modify other skills or system configs.
Guidance
This skill is a packaged copy of Supabase documentation and appears coherent for that purpose — it does not request secrets or install software. Still, before installing or enabling it for autonomous use: 1) Verify the source (the package lists 'unknown'); prefer official or GitHub-sourced documentation when possible. 2) Inspect any files that contain long opaque strings (search for 'base64', 'data:image', or very long single-line blocks) and open the navigation TypeScript file to confirm it isn't executing logic. 3) Remember the SKILL.md warning: do NOT auto-run command examples (they often show how to use tokens or curl with bearer secrets). 4) If you enable autonomous invocation for agents, be cautious — documentation contains examples that reference credentials; ensure the agent is not allowed to execute shell commands or to send extracted secrets to external endpoints. If you want to be extra cautious, use the official Supabase docs online or install a skill only from a verified source.
Latest Release
v0.1.0
Initial release of the Supabase documentation skill. - Provides comprehensive Supabase platform documentation covering authentication, database, storage, edge functions, realtime, AI, cron jobs, queues, and platform management. - Includes security notice: command examples are for reference only and require explicit user approval. - Organized documentation by feature area for easy navigation. - Quick reference table and guidance on where to find answers for common Supabase tasks. - Lists available framework integrations and recommended use cases for the skill.
More by @leonaaardob
Published by @leonaaardob on ClawHub
