supabase-automation

SUSPICIOUS. The skill’s Supabase admin scope broadly matches its stated purpose, but its trust model is inconsistent: it instructs users to use a discontinued Rube endpoint, understates authentication requirements, and routes sensitive Supabase operations through Composio-managed infrastructure instead of Supabase’s current first-party MCP path. This is primarily a third-party trust and credential/data-routing concern, not confirmed malware.