Supabase

This skill appears to implement a legitimate Supabase CLI, but there are a few risks and omissions you should consider before installing: - SUPABASE_SERVICE_KEY is a service-role key (full DB access). Only provide this to code you fully trust; prefer a least-privilege key or a scoped service role if possible. Do not use a production master/service key in an environment you don't control. - The bundled script performs arbitrary SQL and can call a custom exec_sql RPC — this enables full read/write/execution against your DB. Review the script and avoid running it with dangerous SQL until you understand it. - The script uses the OpenAI embeddings API for vector search (sends queries/possibly content to api.openai.com). The script requires OPENAI_API_KEY at runtime, but the skill metadata does not declare this — expect to need to set that env var if you use vector-search. Consider whether you want query text or DB content sent to OpenAI. - The script depends on curl and jq (not declared). Ensure those binaries are available and review the script locally before running. Recommendations: 1) Review the full scripts/supabase.sh file locally line-by-line and run it in a sandboxed environment first. 2) Create and use minimal-privilege keys (read-only or scoped service role) where possible. 3) If using vector search, decide whether sending data to OpenAI is acceptable for your data classification; consider hosting your own embedding/model if needed. 4) Ask the publisher to update the skill metadata to declare OPENAI_API_KEY and required binaries, and to mark SUPABASE_SERVICE_KEY as the primary credential so the privilege is explicit.