seo-publish-article

SUSPICIOUS. The skill's capabilities mostly match its stated purpose of publishing SEO articles, and its network targets are first-party CMS/Supabase endpoints rather than obvious exfiltration services. However, it requires a high-privilege Supabase service-role key, performs direct production writes, and is installed through a transitive third-party skill repo via `npx skills add`, which creates meaningful supply-chain and privilege risk even without clear malicious intent.