mediamath

SUSPICIOUS: the skill is coherent as a MediaMath integration, and its install path is official npm-based rather than a hidden binary. The main concern is proportional but meaningful data-flow expansion: MediaMath access and credentials are mediated by Membrane, a third-party service that handles auth and may retain/log some request data. Floating `@latest` installs add supply-chain risk, but there is not enough evidence of malware or clear credential theft.