Borrowing it
Nothing to install: this file belongs to conectlens/lenserfight. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/conectlens/lenserfight/main/.claude/agents/lenserfight-profile-access-team/03-supabase-rls-lifecycle-engineer/SKILL.mdgit clone --depth 1 https://github.com/conectlens/lenserfightWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/conectlens/lenserfight/03-supabase-rls-lifecycle-engineer)<a href="https://agentmods.dev/skills/conectlens/lenserfight/03-supabase-rls-lifecycle-engineer"><img src="https://agentmods.dev/badge/skills/conectlens/lenserfight/03-supabase-rls-lifecycle-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/conectlens/lenserfight/03-supabase-rls-lifecycle-engineer"><img src="https://agentmods.dev/badge/skills/conectlens/lenserfight/03-supabase-rls-lifecycle-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.00843 |
| Opus 5 | $0.00022 | $0.00421 |
| Sonnet 5 | $0.00009 | $0.00169 |
| Haiku 4.5 | $0.00004 | $0.00084 |
Grade A, and why
supabase-rls-account-lifecycle-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Supabase RLS + Account Lifecycle Engineer
Mission
Enforce privacy and lifecycle rules at the data layer.
Hard requirements
- Private-profile access must be enforced by SQL policy/function, not just route guards.
- Deactivated and pending-deletion accounts must be hidden from non-owners across all reads.
- Deletion must be soft-first, purge-later.
- Sign-in during grace period must cancel pending deletion automatically.
- Legal data retention must be separated from removable content deletion.
Account lifecycle model
States
activedeactivatedpending_deletiondeleted
Transitions
active -> deactivateddeactivated -> activeactive -> pending_deletionpending_deletion -> activeon successful sign-in during grace windowpending_deletion -> deletedafter purge workflow completes
Do not allow direct public reads of deactivated, pending_deletion, or deleted accounts.
RLS approach
Profiles
Create policies so that:
- owner can select own profile for all non-deleted states needed for recovery
- approved followers can select full profile when subject is
activeandvisibility='private' - strangers can select only a restricted-shell projection for
active privateprofiles - everyone can select allowed public projection for
active publicprofiles - blocked viewers get no access or a safer unavailable result depending on product choice
Prefer:
- base tables highly restricted
- security-definer views/functions for controlled projections
Content tables
For threads, prompts, battles, follower lists, etc.:
active public-> visible by normal policyactive private-> visible only to owner and approved followers where policy says yesdeactivated/pending_deletion/deleted-> not visible to non-owner
Deletion model
Removable content
Define separate purge procedures for:
- threads
- prompts
- battle artifacts if removable
- social graph rows
- profile media not legally required
- search index documents
- cache/CDN invalidation records
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 123 lines · 44 tokens per session scan A ae8a124807d2
supabase-rls-account-lifecycle-engineer is a skill published in the GitHub repository conectlens/lenserfight (18 stars, last pushed 1mo ago), licensed MIT. It adds 44 tokens to every session and 843 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
database-expert
Advanced database design and administration for PostgreSQL, MongoDB, and Redis. Use when designing schemas, optimizing queries, managing database performance, or implementing data patterns.
generic-fullstack-feature-developer
Guide feature development for full-stack applications with architecture focus. Covers Next.js App Router patterns, NestJS backend services, database models, data workflows, and seamless integration. Use when adding new features, refactoring existing code, or planning major changes.
multitenant
Architecture multitenant avec approche tiered (Shared/Dedicated Schema/DB), RBAC/ABAC, field-level encryption. Use when working with multitenant applications, tenant isolation, data segregation.
testing-paperclip
Paperclip-Testing-Strategie — Vitest, Plugin-Test-Harness aus @paperclipai/plugin-sdk/testing, echte Postgres-Integration-Tests, Cross-Tenant-Isolation. Verwenden Sie dies beim Schreiben oder Reviewen von Paperclip-Tests.
neon
Neon separates compute and storage, allowing instant database branching and autoscaling. For most Node.js applications, use the @neondatabase/serverless driver over standard pg to leverage WebSocket connections, which bypass serverless environment connection limits.
postgresql
Skill "postgresql" from ashish7802/awesome-api-skills, covering postgresql skill, ecosystem graph preview, recommended next skills, quick start and production patterns.