supabase-audit-rpc

SUSPICIOUS: The skill is internally coherent for Supabase RPC security auditing and does not show third-party credential harvesting, malicious install behavior, or covert exfiltration. However, it explicitly equips the agent to perform active penetration testing against live APIs, including injection and authorization-bypass checks, which makes it high-risk offensive capability despite legitimate same-purpose data flows.