cartql

SUSPICIOUS: the skill's purpose and capabilities are broadly aligned, and the CLI install path appears official via npm and Membrane docs. The main concern is data-flow integrity: CartQL access, authentication, and API requests are routed through Membrane as an intermediary, which is a meaningful third-party proxy risk; combined with mutable `npx @latest`, this makes the skill medium risk rather than benign.