Publisher: Supabase plugin in openai/plugins · Editorial profile by AI Tools Ratings · Review method
What task is this skill designed for?
Use the source to inspect an application boundary such as session handling or row access. Its platform checks help distinguish table privileges from row policies and client keys from server-only credentials.
What input and output should you expect?
Input: A sanitized application route, schema, access matrix and relevant configuration. Specify anonymous, signed-in and privileged roles before asking for a fix.
Output: A targeted patch, access-control explanation and negative test plan tied to the actual user roles.
What does it need to run?
A compatible coding client, current Supabase documentation and project tooling. A staging project is needed to validate real permissions; do not substitute a service-role test for ordinary-user behavior.
Published in the OpenAI Codex plugins repository. Compatibility evidence is the plugin package and its source instructions; this is not a claim of identical behavior in other agent clients.
How should you approach installation?
- Open the pinned source and review the complete skill folder, including referenced helpers and license, before enabling it.
- Use the corresponding plugin in a compatible Codex environment; preserve the skill folder structure rather than copying only SKILL.md. Confirm current plugin availability in your client.
- Start with a disposable project and the trial prompt below. Grant only the stated access, inspect the proposed diff, and require separate approval for remote writes or publishing.
Installation guide: discovery, dependencies and runtime checks
What files, accounts or data can it access?
The workflow can edit code and, with connected tools, change remote schemas or auth settings. Client-side public keys and server secrets have different exposure rules; never put privileged credentials in browser bundles.
What does the skill cost?
Supabase project resources and coding-agent usage are separate costs. Testing may consume database, storage or function quotas; confirm staging limits before load tests.
What are its limits and alternatives?
A successful admin query does not prove users can access the right rows. Session claims may be stale and policy changes need negative tests. Scope the task rather than accepting a blanket security conclusion.
Use the Postgres best-practices skill for a focused query-performance review; use current official auth documentation for a narrow integration question.
What could you ask in a small trial?
Try this with a small sample:
Review a two-user notes table and its frontend query. Propose policies that prevent cross-user reads and owner reassignment. Supply anonymous and authenticated test cases; do not change the live project.
How would you verify the result?
- User A cannot read or update user B records.
- An update cannot transfer ownership without explicit authorization.
- Anonymous access follows the stated product requirement.
- Server-only secrets are absent from client code and logs.
Use a baseline and record acceptance evidence before treating a successful task as a reliable workflow.
Which source and license were checked?
Read the reviewed SKILL.md at its pinned commit · Complete reviewed folder
Repository and current publisher guidance
Checked:
MIT License evidence
Version details and review scope
Source: openai/plugins/plugins/supabase/skills/supabase
Reviewed commit: 0722921d5542fc593105c27bd52630babd8b8c2a
SKILL.md SHA-256: 1171386737b231610fa42485707272765c3516a9bbc0bd2c6c161a8cee3d7d33
Pinned source and license review. This profile covers the source workflow, stated dependencies and license evidence. See our editorial methodology for how we distinguish source reviews and hands-on evaluations.