supabase-agent-skills

SUSPICIOUS. The skill is coherent with its stated Supabase enablement purpose and points to official Supabase sources, with no obvious credential harvesting or exfiltration. However, its core action is transitive skill installation via unpinned remote resolution, which introduces medium supply-chain and inherited-permissions risk even though the publisher/source relationship appears legitimate.