gtmetrix

SUSPICIOUS. The skill's purpose and capabilities mostly align, and the CLI install path is official and coherent with the publisher. The main concern is architectural: GTmetrix access and credentials are mediated through Membrane rather than using the official GTmetrix API flow directly, creating a larger trust boundary and proxy data path. This is not confirmed malware, but it carries moderate security risk due to third-party credential handling, proxy requests, and state-changing actions.