Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Jignesh-Ponamwar/skills-mcp --skill supabase-integrationgit clone --depth 1 https://github.com/Jignesh-Ponamwar/skills-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jignesh-ponamwar/skills-mcp/supabase-integration)<a href="https://agentmods.dev/skills/jignesh-ponamwar/skills-mcp/supabase-integration"><img src="https://agentmods.dev/badge/skills/jignesh-ponamwar/skills-mcp/supabase-integration/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jignesh-ponamwar/skills-mcp/supabase-integration"><img src="https://agentmods.dev/badge/skills/jignesh-ponamwar/skills-mcp/supabase-integration.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00106 | $0.02389 |
| Opus 5 | $0.00053 | $0.01195 |
| Sonnet 5 | $0.00021 | $0.00478 |
| Haiku 4.5 | $0.00011 | $0.00239 |
Grade A, and why
supabase-integration scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLlowData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
const response = await fetch('https://api.resend.com/emails', { method: 'POST', Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 366 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Supabase Integration Skill
Step 1: Setup
npm install @supabase/supabase-js
# Local development
npm install -g supabase
supabase init
supabase start # starts local Postgres + Auth + Storage
Initialize Client
// lib/supabase.ts
import { createClient } from '@supabase/supabase-js'
import type { Database } from './database.types' // generated types
export const supabase = createClient<Database>(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
)
// Server-side client (Next.js App Router)
import { createServerClient } from '@supabase/ssr'
import { cookies } from 'next/headers'
export async function createServerSupabase() {
const cookieStore = await cookies()
return createServerClient<Database>(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
{
cookies: {
getAll: () => cookieStore.getAll(),
setAll: (cookiesToSet) => {
cookiesToSet.forEach(({ name, value, options }) =>
cookieStore.set(name, value, options)
)
},
},
}
)
}
Generate Types
supabase gen types typescript --local > lib/database.types.ts
# Or for remote:
supabase gen types typescript --project-id <project-id> > lib/database.types.ts
Step 2: Database Queries
// SELECT with filter
const { data: users, error } = await supabase
.from('users')
.select('id, name, email, created_at')
.eq('active', true)
.order('created_at', { ascending: false })
.limit(20)
if (error) throw error
// SELECT with related data (join)
const { data: posts } = await supabase
.from('posts')
.select(`
id,
title,
content,
created_at,
author:users (id, name, avatar_url),
comments (id, body, user_id)
`)
.eq('published', true)
// INSERT
const { data: newPost, error } = await supabase
.from('posts')
.insert({
title: 'Hello World',
content: 'My first post',
author_id: userId,
})
.select()
.single()
// UPDATE
const { error } = await supabase
.from('posts')
.update({ title: 'Updated Title' })
.eq('id', postId)
.eq('author_id', userId) // extra safety - only update own posts
// UPSERT
const { data } = await supabase
.from('user_settings')
.upsert({ user_id: userId, theme: 'dark' }, { onConflict: 'user_id' })
.select()
// DELETE
await supabase.from('posts').delete().eq('id', postId)
// Raw SQL (complex queries)
const { data } = await supabase.rpc('get_popular_posts', { limit_count: 10 })
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 366 lines · 106 tokens per session scan A 1417ae260529
supabase-integration is a skill published in the GitHub repository Jignesh-Ponamwar/skills-mcp (8 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 106 tokens to every session and 2,389 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (sends data to an external url). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
supabase
Supabase PostgreSQL backend-as-a-service with realtime. Use for serverless PostgreSQL.
postgres-patterns
PostgreSQL database patterns for query optimization, schema design, indexing, and security. Based on Supabase best practices.
supabase
Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies…
Azure Postgres Ts
Connect to Azure Database for PostgreSQL Flexible Server from Node.js/TypeScript using the pg (node-postgres) package. Use for PostgreSQL queries, connection pooling, transactions, and Microsoft Entra ID (passwordless) authentication. Triggers: "PostgreSQL", "postgres", "pg client", "node-postgres", "Azure PostgreSQL…
azure-postgres-ts
Connect to Azure Database for PostgreSQL Flexible Server from Node.js/TypeScript using the pg (node-postgres) package. Use for PostgreSQL queries, connection pooling, transactions, and Microsoft Entra ID (passwordless) authentication. Triggers: "PostgreSQL", "postgres", "pg client", "node-postgres", "Azure PostgreSQL…
butterbase
AI-native, open-source backend-as-a-service with a built-in Model Context Protocol server. Postgres, auth, storage, functions, AI gateway.