Conciseness

The body is dense with Supabase-specific knowledge Claude cannot be assumed to know (Data API exposure vs RLS, 'auth.role() deprecation', 'TO authenticated alone is BOLA', storage upsert needing INSERT+SELECT+UPDATE), and commands/URLs are given without padding. It stays below 5 because a few items re-explain general Postgres/agent knowledge Claude already has — e.g., 'SECURITY DEFINER functions bypass RLS' and principle 3's generic 'recover from errors, don't loop' advice — which could be trimmed.

Actionability

Guidance is copy-paste executable throughout: 'curl -so /dev/null -w "%{http_code}" https://mcp.supabase.com/mcp', 'supabase migration new <name>', 'supabase db pull <descriptive-name> --local --yes', 'supabase migration list --local', complete SQL policy examples with USING/WITH CHECK, and concrete doc-fetch URLs. Priority-ordered documentation methods and version-gated fallbacks (MCP execute_sql if CLI < v2.79.0) cover the common cases fully.

Workflow Clarity

Multi-step processes are explicitly sequenced with validation checkpoints and feedback loops: the migration commit workflow runs advisors ('Fix any issues') before generating, then verifies with 'supabase migration list --local'; MCP troubleshooting is an ordered 1-2-3 diagnostic sequence; principle 2 mandates post-fix verification; and the security checklist anchors risky database work. This matches the top anchor including the checklist and error-recovery guidance.

Progressive Disclosure

The body is well-sectioned and its one bundle reference is clearly signaled ('MUST read when', references/skill-feedback.md, verified to exist and be one level deep). It is not a 5 because the ~45-line inlined security checklist is exactly the kind of detailed material that could live in a references/ file loaded on demand, and the reference chain reaches two hops (SKILL.md → references/skill-feedback.md → assets/feedback-issue-template.md), leaving minor organization gaps against the 'everything appropriately split' anchor.

Specificity

The description enumerates concrete, specific entities — 'supabase-js, @supabase/ssr', 'getSession, getUser, getClaims, RLS', 'pg_graphql, pg_cron, pg_vector', 'schema changes, migrations, security audits' — giving broad, precise coverage of the domain. It stays at 4 rather than 5 because it lists trigger topics far more than the concrete actions the skill performs; the 'what' is only 'ANY task involving Supabase', so coverage of capabilities is implied rather than listed.

Completeness

The 'when' is fully explicit ('Use when doing ANY task involving Supabase. Triggers: ...'), and the enumerated trigger list conveys scope. It is not a 5 because the 'what' is never explicitly stated — the description never says what the skill does (e.g., provide Supabase CLI/MCP workflows, security checklists, migration guidance), only when to load it. It is clearly above the anchor-3 case ('when' missing or weakly implied) because the trigger clause is prominent and exhaustive.

Trigger Term Quality

Comprehensive natural trigger terms including product names ('Database, Auth, Edge Functions, Realtime, Storage'), framework names users actually say ('Next.js, React, SvelteKit, Astro, Remix'), library package names, auth vocabulary ('login, logout, sessions, JWT, cookies'), and specific API/function names ('getSession, getUser, getClaims, RLS'). This matches the anchor for comprehensive coverage including synonyms and specific identifiers, and no common variation is missing.

Distinctiveness Conflict Risk

Clear niche with distinct triggers: every term is Supabase-branded (supabase-js, @supabase/ssr, Supabase CLI, MCP server) and unlikely to fire for generic Postgres or auth skills. Overlap with a generic Postgres skill is conceivable via 'migrations, RLS', but the Supabase framing dominates, matching the 'clear niche, minimal conflict risk' anchor.