supabase-automation

SUSPICIOUS. The skill's Supabase-focused capabilities broadly match its stated purpose, but its trust model is inconsistent: it routes sensitive admin actions and possible credentials through a third-party MCP service, misstates setup requirements, and points to a now-defunct endpoint rather than Supabase's official MCP. This is more a high-risk intermediary integration than confirmed malware.