bidsketch

SUSPICIOUS. The skill's purpose and capabilities mostly align, and the CLI install comes from an official npm package, not a covert download. However, all Bidsketch access and credential handling are routed through Membrane as a third-party intermediary, including arbitrary proxy requests, which creates medium data-flow and credential-forwarding risk despite being openly documented.