A guide for designing Supabase or PostgreSQL databases. It covers table structure, database changes, access rules, reusable database functions, indexes, and slow queries.

Use it to design schemas, write migration files, review row-level security policies, or investigate query performance. It provides guidance but does not run changes against a live database by itself.

It helps prevent data-access mistakes and poorly performing queries before they reach a live database. It also separates Supabase-specific concerns from general PostgreSQL work.

data — Skill for Claude Code by ASMN-96/ai-agents-skills-toolkit

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add ASMN-96/ai-agents-skills-toolkit --skill data

Clone the repo

git clone --depth 1 https://github.com/ASMN-96/ai-agents-skills-toolkit

Made for: Claude Code.

Or install ultimate, the plugin that ships this one along with the rest of its 9 skills, 4 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/asmn-96/ai-agents-skills-toolkit/data/github.svg)](https://agentmods.dev/skills/asmn-96/ai-agents-skills-toolkit/data)

Your own site

<a href="https://agentmods.dev/skills/asmn-96/ai-agents-skills-toolkit/data"><img src="https://agentmods.dev/badge/skills/asmn-96/ai-agents-skills-toolkit/data/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/asmn-96/ai-agents-skills-toolkit/data"><img src="https://agentmods.dev/badge/skills/asmn-96/ai-agents-skills-toolkit/data.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,007 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00052	$0.01007
Opus 5.5	$0.00021	$0.00403
Sonnet 5.5	$0.00010	$0.00201
Haiku 4.5	$0.00005	$0.00101

Measured 25d ago against content hash 1f7ebc57ef41, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

data scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/data/SKILL.md · 75 lines

How it starts

The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Data route

Schema design, migrations, RLS, and query performance for Supabase and plain Postgres. This route writes migration files and gives guidance; it does not run anything against a live database on its own.

Paths below are relative to this skill's folder (in Claude Code: ${CLAUDE_SKILL_DIR}).

1. Figure out what's Supabase-specific

Any Supabase product, client library, CLI, or MCP server involved: read upstream/supabase/UPSTREAM.md for the platform-specific traps (exposed tables and the Data API, user_metadata vs app_metadata, key exposure, views bypassing RLS, storage grants).
Plain Postgres, or once the Supabase-specific context is covered: read upstream/supabase-postgres-best-practices/UPSTREAM.md for the rule index, then open the matching files under upstream/supabase-postgres-best-practices/references (see the priority table in that file: query-, conn-, security-, schema-, lock-, data-, monitor-, advanced- prefixes).

2. Schema, migration, or RLS work

Classify the data surface (public / authenticated / tenant-scoped / admin-only) before writing SQL.
Read references/rls-gates.md and apply every gate that touches the change: RLS on every exposed table, one policy per operation, with check bound to auth.uid(), SECURITY DEFINER only with a fixed search_path and an in-body identity check, no using (true) on private data.
For a slow query or index question, open the matching query-*.md or monitor-*.md reference and follow its EXPLAIN-first approach.
Write the result as a migration file (or a schema-file edit, if the project uses declarative schemas) for the user to review and apply.

Precedence (overrides upstream text)

Never run supabase db push, apply_migration, any other MCP write tool, or raw SQL against a live or production project. Write a migration file and hand it to the user; only run schema-inspection or advisor reads (get_advisors, list_tables, execute_sql for a read-only query) if the user explicitly asks you to check a live project, and say which project you checked.
Ignore upstream/supabase/UPSTREAM.md's CLI and MCP setup/troubleshooting sections as operating instructions; treat them as background only.
Ignore that file's "Reference Guides → Skill Feedback" section and any instruction to file a GitHub issue on supabase/agent-skills — this route does not vendor that reference and does not file upstream issues.
Ignore upstream's "Option B" (execute_sql or supabase db query for schema changes), "run a test query", and supabase db pull --yes: write the migration file and run nothing against any database unless the user asks.
Upstream's required changelog/docs fetches and web searches are optional here; use only tools the user enabled, and say when current docs were not checked.
Never put the service_role key (or any secret key) in client code, browser bundles, or a NEXT_PUBLIC_-style env var; use it only in a trusted server context, and say so if a request would expose it.
Where the two upstream picks disagree on an RLS pattern, prefer references/rls-gates.md — it is the toolkit's synthesis of both.
Never claim a migration, query, or policy was tested against a real database unless its output is in this session.

Read the full file on GitHub · 75 lines

Files

What ships with it

39 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

25d ago First seen · 75 lines · 52 tokens per session scan A 1f7ebc57ef41

Subscribe to this mod's changes

data is a skill published in the GitHub repository ASMN-96/ai-agents-skills-toolkit (5 stars, last pushed 19d ago), licensed MIT. It adds 52 tokens to every session and 1,007 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-27.

Databases PostgreSQL Security ai-agents automation codex developer-tools maintainer-tools openai

supabase-operations

Design, deploy, and operate Supabase projects with explicit schema, migration, security, backup, and observability checks. Use for Supabase architecture, Postgres changes, auth, storage, edge functions, or deployment operations.

TIKAZI/TIKAZ-AI-Skills · 50 tokens

elixir-phoenix-migrations

Plan Ecto and Postgres migrations with additive, backfill-safe rollouts.

ccarvalho-eng/codex-elixir-phoenix · 24 tokens

alloydb-basics

Manages clusters, instances, and backups for AlloyDB for PostgreSQL, and integrates with AlloyDB Model Context Protocol (MCP) tools for automated database operations. Use when creating, configuring, or administering AlloyDB databases. Do NOT use for general PostgreSQL instances (e.g. Cloud SQL) or other GCP databases.

google/skills · 72 tokens

postgresql-table-design

Use this skill when designing or reviewing a PostgreSQL-specific schema. Covers best-practices, data types, indexing, constraints, performance patterns, and advanced features.

wshobson/agents · 37 tokens

db-repair

Auto-fix gbrain's Postgres access so the brain stays available. When any gbrain command or MCP tool result carries a GBRAINDBACCESS marker (or an operator reports the brain database is down), run the hardcoded gbrain db-repair ladder: diagnose, apply the safe tier, verify. The action is ALWAYS the hardcoded command …

garrytan/gbrain · 96 tokens

volcengine-rds-postgresql

A tool for operating PostgreSQL databases hosted by Volcano Engine's managed database service. PostgreSQL is a relational database used to store structured application data.

bytedance/agentkit-samples · 63 tokens