ifood

SUSPICIOUS. The skill is not overtly malicious and uses a legitimate npm-distributed CLI, but it routes iFood authentication and data operations through Membrane instead of official iFood APIs. That third-party intermediary model, plus unpinned global CLI install and credential/data handling outside the official service path, creates medium security risk and weak data-flow integrity for a narrowly described iFood integration skill.