blog-psquared

SUSPICIOUS: The skill is purpose-aligned and sends data to the expected official Supabase API, so this is not credential harvesting or malware. However, it combines local credential-file access, a highly privileged Supabase service-role key, and fully autonomous public publishing without user confirmation, making the overall risk medium-high despite coherent intent.