supabase-5637b2 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited supabase-5637b2 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Manage Supabase: $ARGUMENTS
akjccuoncxlvrrtkvtno, West US Oregon)postgresql://postgres:[email protected]:54322/postgressupabase/migrations/supabase/config.tomlParse the first word of $ARGUMENTS to determine the command:
status — Show local and hosted statesupabase status for local container healthsupabase migration list to show local vs remote migration driftmigrate — Create a new migrationParse remaining arguments for the migration name.
supabase migration new <name> to create the file/supabase diff to verify, then /supabase push to deploydiff — Diff local schema against migrationssupabase db diff to show schema changes not captured in migrationspush — Push migrations to hosted projectsupabase migration list to show what will be pushedsupabase db push to applysupabase migration list again to confirm syncpull — Pull remote schema to local migrationssupabase db pull to generate a migration from remote schema changesreset — Reset local database to migrationssupabase db reset to drop and re-apply all migrationsinspect — Inspect hosted databaseParse remaining arguments for the inspection type. Default to db-stats.
Available inspections:
db-stats — Size, cache hit rates, WAL sizetable-stats — Table sizes and row countsindex-stats — Index usage and bloatoutliers — Slowest querieslocks — Active locksbloat — Table and index bloat estimatesrole-stats — Role informationRun: supabase inspect db <type> --linked
link — Link or re-link to hosted projectsupabase link --project-ref akjccuoncxlvrrtkvtnosupabase services to verify version alignment| Gotcha | Detail |
|---|---|
| PG version mismatch | CLI upgrades can change local PG version (e.g., 15→17). Old volumes fail with "incompatible data directory". Fix: supabase stop --no-backup, remove volume, supabase start. |
--linked flag inconsistency | Some commands use --linked (e.g., inspect db), others don't support it (e.g., db execute, status). Check --help before assuming. |
| Migration ordering | Migrations sort lexicographically by filename. Use YYYYMMDDHHMMSS_ prefix (supabase CLI does this automatically with migration new). |
| RLS policies | New tables have RLS enabled by default. Forgetting policies means zero rows returned, not errors. Always add policies in the same migration that creates the table. |
db push is irreversible | There is no db unpush. Test migrations locally with db reset first. |
| Service role vs anon key | Admin operations (user management, bypassing RLS) require the service_role key, not the anon/publishable key. Never expose service_role client-side. |
| Local vs hosted auth | Local auth (GoTrue) has different rate limits and email config than hosted. Test auth flows against hosted before shipping. |
These are composable building blocks for workflows:
| Command | Purpose | Implementation |
|---|---|---|
/sb-status | Quick health check | supabase status && supabase migration list |
/sb-new-migration | Create + open migration | supabase migration new <name> then open file |
/sb-sync-check | Drift detection | supabase migration list + diff analysis |
/sb-reset-local | Clean slate local DB | supabase db reset with confirmation |
/sb-push | Deploy migrations | supabase db push with pre-flight check |
These can be wired into .Codex/settings.json:
| Event | Hook | Purpose |
|---|---|---|
PreToolUse:Bash | Guard supabase db push | Require confirmation before pushing to hosted |
PostToolUse:Write | Auto-lint on supabase/migrations/*.sql | Run supabase db lint after writing migration files |
SessionStart | Migration drift check | Run supabase migration list on session start if supabase dir exists |
PreToolUse:Bash | Block supabase stop --no-backup | Prevent accidental data loss without explicit intent |
/sb-status → /sb-new-migration → [write SQL] → /sb-reset-local → [test] → /sb-push/supabase inspect db-stats → /supabase inspect outliers → /supabase inspect bloatgit pull → /sb-sync-check → /sb-reset-local (if drifted) → [verify]Always end with a one-line status summary:
Supabase: [local: running|stopped] [migrations: N local, N remote, N pending] [linked: yes|no]~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.