Repository navigation
feat: Cloud Skill Manager for paid subscribers - #42
Conversation
Cloud-based skill library that lets users save, sync and reuse skills across projects, CLIs and devices. Premium-only (Agent Pass / Enterprise). - Database: cloud_skills + cloud_skill_versions tables with RLS - Server functions: full CRUD, import/export, fork, version history - Subscription guard middleware: enforces paid plan requirement - MCP tools: 6 new tools (list/get/save/delete/export/import) - UI: /account/cloud-skills page with create, edit, import, export - Paywall: non-subscribers see feature overview + upgrade CTA Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W2S6DqgvJiYStfwZR8HPsW
npm ci was failing in CI (on main since June 10) because the lockfile drifted out of sync with package.json — missing rolldown/workerd entries and stale rollup/srvx versions. Regenerated with npm install; all 80 tests in the CI workflow pass locally. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W2S6DqgvJiYStfwZR8HPsW
Resolved package-lock.json conflict by regenerating the lockfile from the merged package.json (npm install --package-lock-only). All 80 CI tests pass locally. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W2S6DqgvJiYStfwZR8HPsW
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6d49605581
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| using (auth.uid() = user_id) | ||
| with check (auth.uid() = user_id); |
There was a problem hiding this comment.
Because this FOR ALL policy only checks ownership, any authenticated free-tier user can call Supabase directly with the public client/REST API and insert, read, update, or delete their own cloud_skills rows, bypassing the server-function and MCP subscription guards entirely. Since this feature is advertised as paid-only and the migration adds a subscription helper below, the RLS checks need to include that paid-subscription predicate rather than relying only on application code.
Useful? React with 👍 / 👎.
| .from("subscriptions") | ||
| .select("status, current_period_end") | ||
| .eq("user_id", userId) | ||
| .in("status", ["active", "trialing", "past_due"]) |
There was a problem hiding this comment.
This guard does not match the rest of billing: useSubscription filters by subscriptions.environment and treats canceled rows as active until current_period_end, while this query does neither. In live, a user with only a sandbox/test subscription row can satisfy this check, and a user who canceled renewal but is still paid through the current period will see the manager UI but get 403s from every server call; the MCP cloud guard repeats the same status query.
Useful? React with 👍 / 👎.
| cloudSkillsSaveTool, | ||
| cloudSkillsDeleteTool, |
There was a problem hiding this comment.
The new mutating cloud tools are registered here, but handle() still treats only upload_packages and request_primitive as WRITE_TOOLS. As a result, unauthenticated cloud_skills_save/cloud_skills_delete calls are not rejected with the 401 WWW-Authenticate response that starts the OAuth flow, and they are logged against read quota before the tool throws; add the cloud write tool names to the gate or introduce an auth-required set for these paid tools.
Useful? React with 👍 / 👎.
What does this PR add?
Cloud-based skill library that lets paid subscribers save, sync and reuse their AI skills across projects, CLIs and devices.
Type
version)Checklist (for content PRs)
N/A — platform feature, not a content PR.
Notes for reviewers
Architecture
Database (
supabase/migrations/20260704120000_cloud_skills.sql):cloud_skillstable — user-owned skills with slug, name, category, tags, content, template variables, versioningcloud_skill_versionstable — version history with changeloghas_active_paid_subscription()helper functionSubscription guard (
src/lib/cloud-skills/subscription-guard.ts):requireSupabaseAuthand verifies active paid subscriptionServer functions (
src/lib/cloud-skills/cloud-skills.functions.ts):createCloudSkill,getCloudSkill,updateCloudSkill,deleteCloudSkill,listCloudSkillsimportCloudSkill,exportCloudSkill(markdown/json/yaml)forkCloudSkill— fork public skills into your own librarygetCloudSkillVersion, auto-versioning on content changeslistCloudSkillCategoriesMCP tools (
src/lib/mcp/tools/cloud-skills.ts):cloud_skills_list,cloud_skills_get,cloud_skills_save,cloud_skills_delete,cloud_skills_export,cloud_skills_importUI (
src/routes/account.cloud-skills.tsx):/account/cloud-skillspagePremium gating
This feature is exclusively for Agent Pass ($19/mo) and Enterprise subscribers. Free-tier users see a paywall with feature highlights and a link to
/pricing. The guard is enforced at both the server function and MCP tool level.Skill format compatibility
Uses the SKILL.md format (Markdown with YAML frontmatter) from the skills-manager ecosystem, compatible with 60+ agents (Claude Code, Cursor, Codex, etc.).
Generated by Claude Code