AI Agents Know About Supabase. They Don't Always Use It Right.

Supabase has released Agent Skills, an open-source set of instructions that teach AI coding agents how to use Supabase correctly. The problem: agents already know about Supabase from training data, but they make critical mistakes — skipping RLS policies, hallucinating CLI commands, creating views without security_invoker=true, and ignoring up-to-date docs. The skill is a ~100-line SKILL.md file covering four areas: documentation access (teaching agents to fetch current docs via MCP, curl, or web search), security (inline checklist of RLS and auth gotchas), tooling (CLI --help discovery and MCP troubleshooting), and schema management (direct SQL edits during dev, then formalize migrations). Testing across Claude Code and Codex showed consistent improvement when using MCP + Skill vs. baseline or MCP alone, with task completion rates rising from 42-71% to 67-88%. Key insight: the bottleneck is context, not capability — agents knew how to implement security_invoker correctly when the skill was loaded, they just didn't know when to apply it.