processflow-process

SUSPICIOUS: the skill’s purpose broadly matches its workflow, but it requires manual extraction of a live Supabase session token from browser localStorage and uses unclear local/browser-side tooling to make real customer-data writes. No clear exfiltration or overt malware is present, yet the auth handling and unverifiable helper-tool provenance make the skill medium risk.