pp-supabase

SUSPICIOUS. The skill’s Supabase-focused capabilities broadly match its stated purpose, but its footprint is larger than necessary because it requires a custom third-party CLI, forwards Supabase credentials into that CLI, and supports arbitrary outbound webhook delivery. This is not confirmed malware, but it is a high-risk trust expansion compared with using official Supabase tools and direct API calls.