Row Level Security policies that hold under an anon key: policy per operation, testing as an unauthenticated caller, and the join that leaks a row the policy meant to hide.
SkillScore91Maintained
Automatic
◆Security & AppSec pack
Last verified 8/3/2026
What it changes
Passed 20 of 22 test cases with the skill, and 18 of 22 without it.
Without skill82%
With skill91%
Checks it passed that the model alone missed
Recommend targeting specific roles using TO anon.
State that foreign key validations execute with table owner permissions.
2 fixed18 passed either way2 still failing0 broke
Pass-rate lift
+9 pp
Tokens
+6%
Agent turns
0%
Response time
+3%
Model gemini-3.6-flashMeasured 8/3/2026v120 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 2
Prompt
I am writing an RLS policy for public blog posts in Supabase. Should the policy target the 'public' pseudo-role or explicitly target 'anon' and 'authenticated'?
What was checked, without and with the skill
Checked
Without skill
With skill
Recommend targeting specific roles using TO anon.
Missed
Passed
case-07 · gemini-3.6-flash · 8/3/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md5 linessingle file
supabase-rls
Row Level Security policies that hold under an anon key: policy per operation,
testing as an unauthenticated caller, and the join that leaks a row the policy
meant to hide.
Use when work should run inside a disposable, confined development box instead of on the host — reviewing a pull request or any untrusted or AI-generated code, letting an agent build and test with full autonomy, running a dev server and driving a real browser against it, and exporting the result as a reviewed patch with an execution receipt. Covers creating a box, running commands and interactive sessions in it, reading what a policy actually enforced, and the output gate.