xoai/skills/stack-nextjs-supabase
skills/stack-nextjs-supabase/SKILL.md
--- name: "stack-nextjs-supabase" description: "Integration seams for Next.js App Router + Supabase: dual-client auth (browser/server), middleware token refresh, RLS policies, typed queries, and real-time subscriptions" version: "1.0.0" type: composite layer: stack requires: sage: ">=1.0.0" skills: - "web" - "baas" - "nextjs" activates-when: detected: [next, @supabase/supabase-js, @supabase/ssr] tags: [next,@supabase/supabase-js,@supabase/ssr] --- # stack-nextjs-supabase **La
$ install --global
skillsauthnpx skillsauth add xoai/sage skills/stack-nextjs-supabaseInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 25, 2026, 2:06 PM120.0s6 files scanned
SKILL.md
- name:
- stack-nextjs-supabase
- description:
- Integration seams for Next.js App Router + Supabase: dual-client auth (browser/server), middleware token refresh, RLS policies, typed queries, and real-time subscriptions
- version:
- 1.0.0
- type:
- composite
- layer:
- stack
- sage:
- >=1.0.0
- detected:
- [next, @supabase/supabase-js, @supabase/ssr]
- tags:
- [next,@supabase/supabase-js,@supabase/ssr]
stack-nextjs-supabase
Layer 3 — Stack Composition
Integration seams for Next.js App Router + Supabase. Covers the five critical integration points that neither Next.js docs nor Supabase docs adequately address together.
Integration Seams
| Seam | What Goes Wrong |
|------|----------------|
| Dual Clients | Agents create one client — auth silently breaks across server/client boundary |
| Middleware Token Refresh | Agents skip middleware — users randomly get logged out on expired tokens |
| RLS as Authorization | Agents rely on Next.js middleware for auth — database is still publicly accessible |
| Typed Queries | Agents use untyped select('*') — typos are silent runtime errors |
| Server Actions | Agents build REST API routes for same-app mutations instead of using Server Actions |
Grounded In
- Supabase official docs: Server-Side Auth for Next.js, @supabase/ssr package
- Supabase official docs: Row Level Security, Creating a Client for SSR
- Security research: 170+ Lovable apps exposed (CVE-2025-48757), 83% of exposed Supabase DBs involve RLS misconfigurations
- Supabase Advanced Guide: CDN caching risks, Vercel Fluid compute client reuse
Loading Order
L1: web (domain) + baas (backend domain)
L2: nextjs (framework) + react (framework)
L3: stack-nextjs-supabase (this pack — integration seams)
Related Skills
xoai/fix
testing
VerifiedTrustedCommunity
Root cause diagnosis with evidence, Reproducing test, Minimal patch
23SKILL.mdUpdated Jul 12, 2026
xoai/continue
tools
VerifiedTrustedCommunity
Session resumption with context
23SKILL.mdUpdated Jul 12, 2026
xoai/configure
tools
VerifiedTrustedCommunity
Configure Sage preset and project settings. Switch between base, startup, enterprise, or opensource constitution presets. Use when the user says "configure sage", "change preset", or "sage settings".
23SKILL.mdUpdated Jul 12, 2026
xoai/build
development
VerifiedTrustedCommunity
Brief (medium+ tasks), Spec, Implementation plan
23SKILL.mdUpdated Jul 12, 2026