supabase-audit-buckets-list

SUSPICIOUS. The skill is internally coherent for a Supabase storage audit and uses official Supabase endpoints without third-party installers or proxy data flows, so it is not indicative of malware. However, it grants an AI agent offensive security-style reconnaissance capability against a live service and persistently records findings, which makes it medium risk even though the required credentials and data flows are proportionate to the stated purpose.