{
  "schemaVersion": 1,
  "skillId": "supabase-platform",
  "revision": "c9be0e931b7930f7d02126d04774d904c381e7d7",
  "runAt": "2026-10-19",
  "mode": "source-review",
  "summary": "Completed 5 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.",
  "sourceManifest": [
    {
      "path": "skills/supabase/SKILL.md",
      "sha256": "697e0e949f97621c6fc1784169eb3ccbf673747d6bb8299a52962d3d84d93dc6",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase/SKILL.md"
    },
    {
      "path": "LICENSE",
      "sha256": "b65e575eb4f04a13c187d64e958321298e2ab84d67aa8428819f362056ba292c",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/LICENSE"
    }
  ],
  "cases": [
    {
      "id": "docs-first",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase/SKILL.md",
      "expected": "Supabase changes frequently",
      "observed": "It tells the agent to check current docs before implementing.",
      "passed": true
    },
    {
      "id": "verify",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase/SKILL.md",
      "expected": "A fix without verification is incomplete.",
      "observed": "Every fix needs a test.",
      "passed": true
    },
    {
      "id": "views-rls",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase/SKILL.md",
      "expected": "**Views bypass RLS by default.**",
      "observed": "The checklist flags views that bypass RLS.",
      "passed": true
    },
    {
      "id": "scoped-tokens",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase/SKILL.md",
      "expected": "Use scoped personal access tokens for the Management API, CLI, and MCP server.",
      "observed": "Agents should use scoped tokens.",
      "passed": true
    },
    {
      "id": "license",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/LICENSE",
      "expected": "MIT License",
      "observed": "The repository license is MIT.",
      "passed": true
    }
  ],
  "results": {
    "passed": 5,
    "failed": 0,
    "total": 5
  },
  "findings": [
    {
      "severity": "high",
      "title": "SQL runs with real privileges",
      "detail": "The skill uses execute_sql and CLI commands that change schemas and policies. Point it at a development project and review migrations before they reach production."
    },
    {
      "severity": "attention",
      "title": "Login tokens can be broader than needed",
      "detail": "The skill notes that the CLI browser login creates a full-access token. Use scoped tokens for agents and CI."
    },
    {
      "severity": "info",
      "title": "Verify every fix",
      "detail": "The skill treats a fix without a test query as incomplete."
    }
  ],
  "limitations": [
    "Source review of SKILL.md and the repository license only. Linked Supabase docs were not reviewed.",
    "No Supabase project was connected and no SQL was run. No security guarantee is claimed."
  ],
  "methodology": "Each source check records the exact source condition and the scoped observation it supports. Counts measure reviewed conditions, not completed user tasks, security assurance or model effectiveness."
}