pb-react-spa

SUSPICIOUS: the skill’s overall purpose is coherent for React+PocketBase setup, and most commands are normal developer workflow. However, it unnecessarily routes PocketBase admin credentials through a third-party CLI and instructs users to persist those credentials in command lines/package.json, creating disproportionate secret exposure and elevated supply-chain trust risk.