lov-dev-blog

SUSPICIOUS: the skill’s purpose and capabilities mostly align, but it automates public blog publication by default and forwards a powerful Supabase service-role key into local repo scripts not shown here. That combination is proportionate to publishing, yet still medium-high risk because it removes per-action approval for a public write and depends on opaque local execution paths.