CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

supabase-storage

Expert guide for Supabase Storage including bucket management, file operations, URL generation, and RLS policies. Use when working with file uploads/downloads, creating public or private buckets, generating signed URLs, implementing storage RLS policies, handling resumable uploads, image transformations, or any Supabase Storage-related tasks.

64

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./supabase-storage/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable — dense, executable code and SQL covering the full storage API surface — but it is a monolithic ~720-line reference that inlines everything (resumable-upload client guides, the full RLS policy catalog, Edge Function proxying) instead of splitting it into reference files. It also lacks validation checkpoints around destructive operations (delete/empty bucket, bulk remove) and carries padding (role preamble, duplicated policies, summary restating the TOC).

Suggestions

Split the bulk into one-level-deep reference files (e.g., references/resumable-uploads.md for the tus/Uppy guides, references/rls-policies.md for the policy catalog and Edge Function proxy) and keep SKILL.md as a concise overview with clearly signaled links, per the progressive_disclosure rubric.

Add explicit validation guidance around destructive and batch operations — e.g., verify a signed URL fails for another user before relying on a policy, list files to confirm the target set before emptyBucket/remove, and check that RLS is enabled on storage.objects after running the setup SQL — to lift workflow_clarity above 3.

Trim the role preamble, the 'Key Components' section, the duplicated 'Complete Setup Example' policies, and the closing Summary to reduce token cost, and fix the minor code gaps (undefined `bucketName`, inconsistent resumable endpoint host, version-pinned CDN import) for fully copy-paste-ready examples.

DimensionReasoningScore

Conciseness

The bulk is genuinely useful, executable code, so it is mostly efficient — but several sections are unnecessary: the "You are an expert" role preamble, "Key Components" explaining what buckets/objects are, the "Complete Setup Example" repeating four RLS policies verbatim from section 5, and a closing "Summary" that restates the table of contents. This fits anchor 3 (mostly efficient, some tightening possible) better than anchor 2, whose padding dominates the content.

3 / 5

Actionability

Nearly all examples are concrete, copy-paste-ready JavaScript/TypeScript/SQL covering the common cases (upload, download, list, signed URLs, RLS policies). Minor gaps keep it below anchor 5: the signed-upload example uses an undefined `bucketName` variable, the tus example's endpoint host (`${projectId}.storage.supabase.co`) is inconsistent with the Uppy example's (`${projectId}.supabase.co`), and the Uppy snippet pins a CDN version (v3.6.1) with a placeholder token.

4 / 5

Workflow Clarity

The body is a well-ordered API catalog rather than a sequenced workflow, and it contains no validation checkpoints for risky operations: "Delete Bucket", "Empty Bucket", and bulk "Remove Files" appear with no verify-before-destructive guidance, and RLS policies are given without a check-that-RLS-is-enabled or test-the-policy step. Per the rubric, missing validation for destructive/batch operations caps this at 3; the numbered section structure keeps it from scoring lower.

3 / 5

Progressive Disclosure

The body has clear structure (9 numbered sections with headers), but it is a ~720-line monolith with no bundle files at all: the full tus/Uppy resumable-upload guides, the complete RLS policy catalog, and the Edge Function proxy are all inlined content that clearly belongs in separate reference files. This matches anchor 3 (some structure, content that should be separate is inline) — better organized than anchor 2's header-less dump, but without any of the well-signaled references that anchor 4+ requires.

3 / 5

Total

13

/

20

Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it clearly states the domain, enumerates its main capability areas, and provides an explicit, keyword-rich 'Use when' clause covering the natural trigger phrases for the domain. The only weakness is that the 'what' portion uses slightly generic category nouns ("file operations") instead of enumerating the concrete operations, and "Expert guide for" is minor filler.

DimensionReasoningScore

Specificity

The description lists several specific capability areas — "bucket management, file operations, URL generation, and RLS policies" plus concrete triggers like "generating signed URLs", "handling resumable uploads, image transformations" — but the 'what' half relies on category nouns ("file operations", "bucket management") rather than enumerated concrete actions like the anchor-5 example, and "Expert guide for" is mild filler. It sits noticeably above the midpoint, matching anchor 4 rather than 5.

4 / 5

Completeness

It explicitly answers both questions: 'what' via "Expert guide for Supabase Storage including bucket management, file operations, URL generation, and RLS policies" and 'when' via the explicit clause "Use when working with file uploads/downloads, creating public or private buckets, generating signed URLs, implementing storage RLS policies, handling resumable uploads, image transformations". This matches anchor 5's what-and-when-with-concrete-triggers pattern; it is clearly above anchor 4, whose 'when' is less specific.

5 / 5

Trigger Term Quality

Natural trigger phrases a user would actually say are comprehensively covered: "file uploads/downloads", "creating public or private buckets", "generating signed URLs", "storage RLS policies", "resumable uploads", "image transformations", with the domain name "Supabase Storage" repeated and a catch-all "any Supabase Storage-related tasks". No relevant file extensions exist for this domain, so the synonym-coverage bar of anchor 5 is met.

5 / 5

Distinctiveness Conflict Risk

"Supabase Storage" is a clear niche with distinct, storage-scoped triggers (buckets, signed URLs, storage RLS) that would not fire for unrelated skills; only trivial overlap with a hypothetical general Supabase skill exists, matching anchor 5's minimal conflict risk.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (724 lines); consider splitting into references/ and linking

Warning

Total

15

/

16

Passed

Repository

Raudbjorn/claude

Path

supabase-storage/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.