Skills lovable

📦

lovable

Name: lovable
Author: 10K-Digital

Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Guide Lovable Deployments with Claude Code

Lovable projects need careful GitHub, Supabase, and deployment coordination. This skill gives Claude, Codex, and Claude Code structured prompts and workflow rules for Lovable backend changes.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "lovable" from https://skillstore.io/skills/10k-digital-lovable.md and its manifest at https://skillstore.io/api/skills/10k-digital-lovable/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/10k-digital-lovable.md Signed manifest GET /api/skills/10k-digital-lovable/manifest Signed lockfile GET /api/skills/10k-digital-lovable/lockfile

Test it

Using "lovable". User asks to deploy the send-email edge function after code changes.

Expected outcome:

The skill identifies that Supabase Edge Functions need Lovable deployment.
It returns the prompt: Deploy the send-email edge function.
It warns to confirm required secrets before deployment.

Using "lovable". User creates a migration for a profiles table.

Expected outcome:

The skill explains that migration files sync through GitHub but need Lovable to apply. It provides a review checklist and the apply migration prompt.

Using "lovable". User asks why changes are not visible in Lovable.

Expected outcome:

The skill checks branch, push status, and sync delay. It recommends waiting one to two minutes after pushing to main.

Security Audit

High Risk

v7 • 7/4/2026 Open versioned report

Most static alerts are Markdown false positives from inline code, prompt examples, placeholder URLs, and documented secret names. No prompt injection or credential exfiltration text was found. Two contextual risks remain: broad GitHub push guidance and optional yolo automation that can submit Lovable deployment actions.

Files scanned

1,650

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

references/CLAUDE-template.md:114-125

Broad GitHub Publish Workflow

The generated CLAUDE template says "ALWAYS do this" and uses git add . followed by a push to main. This can publish unreviewed local files or secrets to GitHub if an agent follows it without confirmation.

The cited lines explicitly require committing all changes and pushing main. The risk is contextual because the dangerous part is the broad workflow, not the Markdown syntax.

High

references/CLAUDE-template.md:229-264 SKILL.md:264-281

Automated Lovable Deployment Actions

Yolo mode can auto-submit Lovable prompts through MCP or browser automation after git push. If enabled without a final approval step, it can deploy edge functions or apply migrations unexpectedly.

The documentation says prompts are auto-submitted through MCP or browser automation and lists edge deployment and migration operations. This is a clear side-effect risk when enabled.

Risk Factors

⚙️ External commands (131)

🌐 Network access (3)

references/CLAUDE-template.md:273 references/secret-detection.md:77 references/secret-detection.md:223

🔑 Env variables (46)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/10k-digital-lovable/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/10k-digital-lovable/security.svg)](https://skillstore.io/skills/10k-digital-lovable?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/10k-digital-lovable?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/10k-digital-lovable/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/10k-digital-lovable.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

10K-Digital. (2026). lovable security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/10k-digital-lovable/audits/7

BibTeX citation

@techreport{10k-digital-10k-digital-lovable-2026,
  author = {10K-Digital},
  title = {lovable security audit report (audit version 7)},
  institution = {Skillstore},
  year = {2026},
  number = {7},
  url = {https://skillstore.io/skills/10k-digital-lovable/audits/7},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lovable security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
  - name: "10K-Digital"
date-released: "2026-07-04"
url: "https://skillstore.io/skills/10k-digital-lovable/audits/7"
identifiers:
  - type: other
    value: "skillstore:10k-digital-lovable:audit:7"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Coordinate Lovable Backend Changes

Plan edge function, migration, and secret updates while knowing what GitHub sync can and cannot deploy.

Prepare Safe Deployment Prompts

Generate exact Lovable prompts for database, RLS, storage, auth, and edge function operations.

Map a Lovable Codebase

Document project architecture, key files, data flow, and common navigation paths for faster AI assistance.

Try These Prompts

Identify Project Architecture

Check whether this Lovable project uses Vite SPA or TanStack Start. Tell me which files sync automatically and what needs Lovable deployment.

Prepare Edge Function Deployment

I changed the [function name] edge function. Review the changes, list required secrets, and give me the exact Lovable deployment prompt.

Apply a Migration Safely

Review the pending Supabase migration for destructive changes. Explain the risk, then provide the Lovable prompt to apply it if safe.

Plan Controlled Yolo Automation

Assess whether yolo mode is appropriate for this project. If it is, define the deployment method, testing level, and manual fallback.

Best Practices

Review generated Lovable prompts before running them in production.
Confirm branch, staged files, and secrets before any GitHub push.
Use yolo mode only with explicit deployment settings and verification tests.

Avoid

Running broad git add and push commands without reviewing staged files.
Applying database migrations before checking RLS, data loss, and rollback impact.
Treating preview tokens, API keys, or .env values as safe to commit.