easyly

SUSPICIOUS: The skill’s purpose broadly matches its capabilities, and installation uses npm rather than a raw download-execute chain, which reduces supply-chain concern. However, all Easyly access is mediated through the Membrane CLI/service instead of direct official Easyly endpoints, creating third-party credential and data-routing exposure that is broader than a simple Easyly integration guide implies. The unpinned global CLI install and partial publisher-name mismatch add moderate trust risk, but there is no clear evidence of malware, exfiltration to known capture endpoints, hidden behavior, or disproportionate local credential/file access.