After my last post on the 7 mistakes AI coding agents make in Next.js + Supabase apps, a few people asked for the rules in a drop-in format. So I packaged them as SKILL.md agent skills that work in Claude Code, Cursor and Codex CLI.
Free: ShipSafe Lite
Four rules that stop the worst mistakes:
- Keep the Supabase service role key server-side only
- RLS on for every table, with real policies
- Verify auth on the server with
getUser(), never trust the client - Stay in scope: no surprise refactors or migrations
Get it: https://skillhq.dev/skills/tommy/shipsafe-nextjs-supabase-lite
Full: ShipSafe Rules (€2)
All 12 rules (secrets, RLS, auth, rate limits, errors and logging, Stripe webhooks, uploads and storage, AI endpoints, background jobs, PII in logs, a ship checklist), plus a pre-deploy audit prompt, Claude Code settings that block reading .env and destructive Supabase commands, and an AGENTS.md for Codex.
Get it: https://skillhq.dev/skills/tommy/shipsafe-nextjs-supabase
Feedback welcome: which mistake does your agent make most?
Disclosure: I made these and the full version is paid.
Top comments (0)