Content
72%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a strong, highly actionable pattern library: complete, executable code for the full Supabase + Next.js + Drizzle stack with minimal padding. Its two weaknesses are the absence of validation/ownership checks in the destructive server actions and the monolithic single-file structure with no progressive disclosure into reference files.
Suggestions
Add ownership checks and error handling to the mutation actions (e.g., .where(and(eq(posts.id, id), eq(posts.authorId, user.id))) and checking the returned row count) so destructive operations have validation.
Move the secondary example sections (Storage, Realtime, OAuth Providers) into references/ files (e.g., references/storage.md, references/realtime.md) and keep SKILL.md as a lean overview with one-level-deep pointers.
Add a brief numbered build sequence (install → env → schema → clients → middleware → auth pages) so a fresh project has an explicit order of operations.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is almost entirely executable code with terse framing ("Drizzle for queries, Supabase for auth/storage, server components by default") and no explanations of concepts Claude already knows; only minor bulk (full login form, OAuth buttons, sign-out button) could be trimmed or externalized. This matches 'Efficient; minor instances of over-explanation that could be trimmed' rather than 5, since some complete UI components pad the token cost. | 4 / 5 |
Actionability | Every section provides copy-paste-ready, complete TypeScript: install commands, env vars, drizzle.config.ts, all three Supabase clients, middleware, auth helpers, server actions, queries, storage, and realtime — matching 'Fully executable; copy-paste ready code or commands; specific examples cover the common cases'. | 5 / 5 |
Workflow Clarity | Sections are ordered sensibly (setup → clients → middleware → auth → data), but the destructive/batch database operations have no validation or feedback loops: updatePost and deletePost perform no ownership check (they filter only on posts.id, not authorId) and no verify step after mutation. Per the rubric's cap, destructive operations without validation cannot score above 3. | 3 / 5 |
Progressive Disclosure | The body has clear, well-labeled sections and cites upstream docs, but ~700 lines are entirely inlined in SKILL.md with no bundle files at all — storage, realtime, and OAuth content clearly belongs in separate reference files, matching 'Some structure but could be better organized; content that should be separate is inline'. It is not a 2 because section headers make navigation easy. | 3 / 5 |
Total | 15 / 20 Passed |