supabase-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited supabase-cli (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
CLI automation and operational tooling for Supabase development workflows. This skill provides scripts and utilities for common Supabase operations with built-in safety checks.
Invoke when:
# Supabase CLI
brew install supabase/tap/supabase
# or: npx supabase / npm i supabase --save-dev (global npm install is NOT supported)
# Verify installation
supabase --versionBefore running scripts, validate credentials with:
python3 .claude/skills/supabase-cli/scripts/validate_env.pyRequired variables:
| Variable | Description | Required For |
|---|---|---|
SUPABASE_URL | Project URL | All operations |
SUPABASE_ANON_KEY | Public/anon key | Client operations |
SUPABASE_SERVICE_ROLE_KEY | Service role key | Admin operations |
POSTGRES_DB | Direct PostgreSQL URL | Migrations, SQL |
SUPABASE_ACCESS_TOKEN | CLI access token | supabase link, db push, gen types |
The access token is required for CLI operations like linking projects, pushing migrations, and generating types.
How to get your token:
sbp_)How to use it:
Option 1: Store in .env.local (recommended for projects):
# .env.local (add to .gitignore!)
SUPABASE_ACCESS_TOKEN=sbp_your_token_hereOption 2: Export in terminal session:
export SUPABASE_ACCESS_TOKEN="sbp_your_token_here"Option 3: Interactive login (opens browser):
supabase loginLink your project (required before pushing migrations):
# Extract project ref from your SUPABASE_URL (the subdomain)
# Example: https://abcdefghijkl.supabase.co → project ref is "abcdefghijkl"
supabase link --project-ref <your-project-ref>| Task | Script | Example |
|---|---|---|
| Validate env | validate_env.py | python3 scripts/validate_env.py |
| New migration | migration_new.ts | bun scripts/migration_new.ts add-users |
| Apply migrations | migration_apply.ts | bun scripts/migration_apply.ts --local |
| Generate types | update_types.ts | bun scripts/update_types.ts |
| Run SQL safely | safe_sql_runner.ts | bun scripts/safe_sql_runner.ts --query "SELECT 1" |
| Check drift | check_drift.sh | bash scripts/check_drift.sh |
| New Edge Function | func_new.ts | bun scripts/func_new.ts my-function |
| Deploy function | func_deploy.ts | bun scripts/func_deploy.ts my-function |
| Sync secrets | secret_sync.py | python3 scripts/secret_sync.py --dry-run |
| Manage secrets | manage_secrets.py | python3 scripts/manage_secrets.py list |
| Reset local DB | reset_local.ts | bun scripts/reset_local.ts |
| Run DB tests | test_db.ts | bun scripts/test_db.ts |
| Scaffold RLS | scaffold_rls.ts | bun scripts/scaffold_rls.ts users --tenant |
bun .claude/skills/supabase-cli/scripts/migration_new.ts add_user_rolessupabase/migrations/ bun .claude/skills/supabase-cli/scripts/migration_apply.ts --local bash .claude/skills/supabase-cli/scripts/check_drift.sh bun .claude/skills/supabase-cli/scripts/migration_apply.ts --remote --confirm bun .claude/skills/supabase-cli/scripts/update_types.ts bun .claude/skills/supabase-cli/scripts/func_new.ts webhook-handler --template webhook supabase functions serve webhook-handler bun .claude/skills/supabase-cli/scripts/func_deploy.ts webhook-handler python3 .claude/skills/supabase-cli/scripts/secret_sync.py --prefix APP_ --dry-run
python3 .claude/skills/supabase-cli/scripts/secret_sync.py --prefix APP_ python3 .claude/skills/supabase-cli/scripts/manage_secrets.py list bun .claude/skills/supabase-cli/scripts/reset_local.ts bun .claude/skills/supabase-cli/scripts/test_db.tsGenerate RLS policies for new tables:
# Standard user-based policies
bun .claude/skills/supabase-cli/scripts/scaffold_rls.ts products
# Multi-tenant policies (for restaurant_id based isolation)
bun .claude/skills/supabase-cli/scripts/scaffold_rls.ts orders --tenant
# Output to migration file
bun .claude/skills/supabase-cli/scripts/scaffold_rls.ts menu_items --tenant --output supabase/migrations/015_rls.sqlScripts classify SQL statements by risk level:
| Level | Statements | Behavior |
|---|---|---|
| Safe | SELECT, EXPLAIN, SHOW | Execute immediately |
| Write | INSERT, UPDATE, DELETE, ALTER, CREATE | Require transaction wrap |
| Dangerous | DROP, TRUNCATE, DELETE (no WHERE) | Require --confirm flag |
The following require explicit --confirm flag:
Before deploying Edge Functions:
The CLI surface changes (e.g. db execute was removed in favor of db query; db push targets the linked REMOTE by default). On any error: supabase <command> --help → if unclear, WebFetch https://supabase.com/docs/reference/cli/supabase-<command> (dashes join subcommands) → adjust → re-run.
REFUSED: `supabase <command>` is destructive against the linked remote project.
I won't skip confirmation. Either (1) confirm the target explicitly
(--local vs --linked), or (2) run it in the Supabase Dashboard.For detailed information:
| Topic | Reference File |
|---|---|
| CLI commands | references/cli-commands.md |
| Migration patterns | references/migration-patterns.md |
| Troubleshooting | references/troubleshooting.md |
When scripts detect missing credentials, they output in this format:
MISSING: SUPABASE_SERVICE_ROLE_KEY
ASK_USER: Please provide your Supabase Service Role Key.
LOCATION: Dashboard > Project Settings > API > service_role keyClaude should parse this and use AskUserQuestion to prompt for the missing credential.
Pairs with:
/plan-feature - Database schema design during feature planningbrainstorm - Architecture decisions before migrationsbeautiful-code - TypeScript type generation quality~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.