miro-developer-app

SUSPICIOUS: The skill’s capabilities broadly match its Miro integration purpose, and the CLI install path is a normal npm package rather than an obvious malware dropper. The main concern is data-flow integrity and scope expansion: all auth and API activity are routed through Membrane as an intermediary, and the skill can dynamically create/run actions with write effects. This is not fundamentally incompatible with the stated purpose, but it creates medium trust and security risk versus a direct Miro-only integration.