safe-sql-execution

What the skill teaches

A maintainer skill in the Supabase monorepo that the agent loads before writing Supabase Studio code that builds, fetches, stores or runs SQL. Its rule is that people may run SQL they wrote themselves, but SQL that outside input such as URL parameters or model output could shape must never run on its own. Fragments are typed as safe, untrusted or user-written; values go through identifier, literal and keyword helpers; saved snippets stay untrusted; and promotion of untrusted SQL is allowed only inside a click handler, never in queries, render code or effects. The execution function accepts only safe fragments, so the type checker enforces this, and analytics log queries use a separate type and lint rule.

Capabilities

Details