Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add volcengine/volcengine-skills --skill volcengine-db-supabasegit clone --depth 1 https://github.com/volcengine/volcengine-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/volcengine/volcengine-skills/volcengine-db-supabase)<a href="https://agentmods.dev/skills/volcengine/volcengine-skills/volcengine-db-supabase"><img src="https://agentmods.dev/badge/skills/volcengine/volcengine-skills/volcengine-db-supabase/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/volcengine/volcengine-skills/volcengine-db-supabase"><img src="https://agentmods.dev/badge/skills/volcengine/volcengine-skills/volcengine-db-supabase.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00239 | $0.07340 |
| Opus 5.5 | $0.00096 | $0.02936 |
| Sonnet 5.5 | $0.00048 | $0.01468 |
| Haiku 4.5 | $0.00024 | $0.00734 |
Grade A, and why
volcengine-db-supabase scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
91% identical to byted-supabase — 102 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 317 lines — stays where its author put it; the contents beside it link to each section on GitHub.
火山引擎 AI 原生 BaaS 平台 · Supabase 版
本 Skill 用于在对话中充当火山引擎「AI 原生 BaaS 平台 Supabase 版」的智能运维与开发代理。
ℹ️ 这是火山引擎自研的 AI 原生 BaaS 平台（Supabase 版），不是官方开源 Supabase。 它在 Supabase 协议/生态之上做了火山引擎的平台化适配，与官方存在差异：
- 用
byted-supabase-cli操作（不是官方supabaseCLI），通过 火山引擎账号 / AK-SK 鉴权；- 资源模型为 workspace（工作区）/ branch（分支）/ compute（算力），并有
endpoints、computes等火山专有命令；- 部分命令、参数与行为与官方 Supabase CLI 不同。
👉 操作以本 Skill 文档与
byted-supabase-cli <command> --help为准，不要套用官方 Supabase CLI 的命令习惯。
它会：
- 识别用户的 Supabase 自然语言需求
- 直接调用
byted-supabase-cli命令行工具获取实时结果 - 基于返回结果做解释、排障和下一步建议
核心原则
本节为通用工作纪律，任何 Supabase 任务都应遵守。
1. 平台演进快 —— 先查在线文档/发布记录，不要只信训练数据。
命令、参数、config 项、API 约定会随版本变化。动手前先查火山引擎官方文档与发布记录（见文末在线文档），尤其涉及不确定的命令/参数时；CLI 子命令一律 byted-supabase-cli <command> --help 现查，不要凭记忆猜命令。
2. 验证你的工作。 任何变更落地后，再跑一条只读查询确认生效。没有验证的修复＝未完成。
3. 从错误中恢复，不要死循环。 同一方法连续失败 2-3 次就停下来换思路：换方法、查文档、更仔细地看报错、必要时查日志。Supabase 类问题不总是靠重试同一条命令解决。
4. 把表暴露给 Data API（REST）。 新建的表不一定自动通过 Data API 暴露。若要让 anon / authenticated 角色经 REST 访问某表，需显式 GRANT。
注意：这与 RLS 是两回事 —— Data API 暴露 + 角色授权决定表是否可达；RLS 决定表可达后哪些行可见。当用户反馈"SQL 建的表访问不到"，先确认是否已授权这两个角色。对外（anon/authenticated）授权时务必同时启用 RLS。
5. ⛔ 高危红线：projects stop（暂停 workspace）会让客户业务彻底不可用。
暂停后的实例无法靠客户 IO / 访问流量自动唤醒（这与分支休眠的「访问即唤醒」本质不同）——整个 workspace 及其下所有分支停服，REST / Auth / Storage / 直连 DB 全部不可达，必须由人手动 projects start 才能恢复。因此执行 projects stop 前必须：
- 向用户明确复述影响并取得二次确认——「这会停掉整个 workspace
<ref>，期间客户业务完全不可用、且不会自动恢复，确认吗？」- 核对目标
ref无误，绝不停错 workspace；- 绝不把它当作「重启 / 休眠 / 省资源」的手段——重启用
branches restart，休眠是平台自动行为，二者都不会导致业务停服。（
projects delete同属不可逆高危操作，同样需先确认。）
6. 暴露 schema 内的表必须启用 RLS。 任何对外暴露的 schema（默认含 public）里的每张表都要 ENABLE ROW LEVEL SECURITY；私有 schema 也建议启用作为纵深防御。启用后，按真实访问模型写策略，不要无脑给每张表套同一个 auth.uid() 模式。
7. 安全 checklist。 凡涉及 Auth、RLS、视图、Storage 或用户数据的任务，逐条过一遍下面这些 Supabase 特有的安全陷阱（完整版见 references/security-guide.md）：
What ships with it
20 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/app-integration-guide.md 14 KB
- references/deploy-provider.md 5.6 KB
- references/edge-function-dev-guide.md 9.4 KB
- references/iam-permission-guide.md 3.5 KB
- references/pg-best-practices/advanced.md 3.8 KB
- references/pg-best-practices/conn.md 6.5 KB
- references/pg-best-practices/data.md 6.0 KB
- references/pg-best-practices/index.md 1.7 KB
- references/pg-best-practices/lock.md 6.7 KB
- references/pg-best-practices/monitor.md 4.6 KB
- references/pg-best-practices/query.md 7.1 KB
- references/pg-best-practices/schema.md 9.9 KB
- references/pg-best-practices/security.md 7.0 KB
- references/rls-guide.md 9.4 KB
- references/schema-guide.md 8.4 KB
- references/security-guide.md 6.2 KB
- references/sql-playbook.md 5.6 KB
- references/tool-reference.md 23 KB
- references/workflows.md 8.0 KB
- scripts/supabase_dataplane.py 31 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 317 lines · 239 tokens per session scan A 8fbb740658fe
volcengine-db-supabase is a skill published in the GitHub repository volcengine/volcengine-skills (22 stars, last pushed 12d ago), licensed MIT. It adds 239 tokens to every session and 7,340 once invoked, about $0.0010 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 91% identical to byted-supabase, differing in 102 lines, and is treated as a copy.
Other skills, from other repositories
event-store-design
Design and implement event stores for event-sourced systems. Use when building event sourcing infrastructure, choosing event store technologies, or implementing event persistence patterns.
platform-custom-field-generate
Use when users create, generate, or validate Salesforce Custom Field metadata. Trigger on custom fields, field types, Roll-Up Summary, Master-Detail/Lookup relationships, formula fields, picklists, dependent (controlling) picklists, referencing a value set from a field, or scoping picklist values per record type; also…
field-service-sobject-create-configure
Headless 360 REST API deployment step for creating sObject records. Handles describe-based field discovery, required-field derivation, entity-relationship ordering, and composite graph transactions. Use this skill when a designer skill (or a user directly) needs to create sObject records after design confirmation…
durable-objects
Build, debug, or review Cloudflare Durable Objects code for persistent state and coordination.
nornicdb-grpc
Drive NornicDB over gRPC — the Qdrant-compatible surface (Collections, Points, Snapshots) plus the additive NornicSearch service. Use when ingesting via Qdrant SDKs, migrating from Qdrant, or running hybrid text+vector search from a non-Bolt client. Covers connection, RPC catalog, collection→database mapping…
output-dev-credentials
Store and reference encrypted secrets in Output SDK workflows using @outputai/core/credentials. Use when integrating API keys, database passwords, or third-party tokens.