cardinal

SUSPICIOUS: The skill is broadly aligned with a Cardinal integration and uses an official npm-distributed Membrane CLI, so it does not show clear malware behavior. However, it routes all Cardinal access through Membrane as an intermediary and grants broad proxy-based API access, which expands data exposure beyond a direct first-party integration and makes the footprint somewhat disproportionate to a simple app skill.