circleci

SUSPICIOUS: The skill's general purpose matches CircleCI management, and the CLI install source appears official. However, it routes authentication and API traffic through Membrane rather than directly to CircleCI, creating a disproportionate trust dependency and third-party visibility into sensitive CI/CD operations. This is not confirmed malware, but it carries meaningful security and credential-handling risk.