← Back to Skills Marketplace
Supabase
by
Lucas Synnott
· GitHub ↗
· v1.0.0
10611
Downloads
17
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install supabase
Description
Connect to Supabase for database operations, vector search, and storage. Use for storing data, running SQL queries, similarity search with pgvector, and managing tables. Triggers on requests involving databases, vector stores, embeddings, or Supabase specifically.
Usage Guidance
Review before installing. Use this only for projects where the agent is allowed full database access, prefer a restricted credential or isolated project when possible, double-check every update/delete/raw SQL request, and avoid vector-search queries containing sensitive text unless sending that text to OpenAI is acceptable.
Capability Analysis
Type: OpenClaw Skill
Name: supabase
Version: 1.0.0
The OpenClaw AgentSkills skill bundle for Supabase is classified as benign. The skill's purpose is to interact with Supabase, which inherently requires access to sensitive environment variables like `SUPABASE_SERVICE_KEY` (full access) and `OPENAI_API_KEY` for vector search. The `SKILL.md` documentation clearly outlines these requirements and the commands, without any prompt injection attempts against the agent. The `scripts/supabase.sh` script uses `curl` to interact with Supabase and OpenAI, properly escaping all user-provided input (e.g., SQL queries, JSON data) using `jq -Rs .` to prevent shell injection vulnerabilities. All network calls are directed to the specified Supabase URL and the OpenAI API, aligning with the stated functionality without evidence of data exfiltration to unauthorized endpoints or other malicious activities.
Capability Assessment
Credentials
The skill requires a service-role Supabase credential for routine operations, does not validate SUPABASE_URL before sending that credential, and vector-search sends query text to OpenAI when OPENAI_API_KEY is configured.
Install Mechanism
No installer, dependency installation, hook, background service, or self-modifying setup behavior was observed; the artifact is a Markdown skill plus a local shell wrapper.
Instruction Scope
The trigger text is broad for database, vector store, and embedding requests, while runtime instructions allow raw SQL, updates, deletes, and RPC calls without explicit confirmation or narrow routing for high-impact actions.
Persistence & Privilege
No persistence mechanism was found, but runtime privilege is high because the service-role key can bypass Row Level Security and authorize reads, writes, deletes, raw SQL via RPC, and stored procedure calls.
Purpose & Capability
The database, raw SQL, CRUD, RPC, and vector-search capabilities fit the stated Supabase purpose, but they run with a SUPABASE_SERVICE_KEY described as full access; the description also advertises storage even though no storage command is implemented.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install supabase - After installation, invoke the skill by name or use
/supabase - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: Database operations, CRUD, vector similarity search with pgvector, table management
Metadata
Frequently Asked Questions
What is Supabase?
Connect to Supabase for database operations, vector search, and storage. Use for storing data, running SQL queries, similarity search with pgvector, and managing tables. Triggers on requests involving databases, vector stores, embeddings, or Supabase specifically. It is an AI Agent Skill for Claude Code / OpenClaw, with 10611 downloads so far.
How do I install Supabase?
Run "/install supabase" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Supabase free?
Yes, Supabase is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Supabase support?
Supabase is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Supabase?
It is built and maintained by Lucas Synnott (@lucassynnott); the current version is v1.0.0.
More Skills