supabase-agent-skills

SUSPICIOUS: the skill is purpose-aligned and points to an official Supabase repo, so there is no strong sign of malicious intent or credential harvesting. However, its main function is transitive skill installation through third-party npm CLIs, and the optional Claude plugin instructions are outdated/inconsistent with current official docs, so the trust chain and install ambiguity make it medium risk rather than benign.