civicrm

SUSPICIOUS. The skill’s capabilities fit its CiviCRM purpose, and the CLI comes from an official npm package tied to the same vendor, so there is no strong malware signal. However, all CRM access and credentials are routed through Membrane rather than directly to CiviCRM, and the proxy/request features plus record mutation abilities create meaningful third-party trust and data-flow risk.