onethread

SUSPICIOUS: The skill’s purpose broadly matches its capabilities, but it routes all Onethread access through Membrane’s intermediary CLI/service instead of the official Onethread API, creating a third-party trust and data-flow dependency. Install source is the official npm registry and appears consistent with Membrane branding, so this is not confirmed malicious, but the proxy-style architecture, required Membrane account, and unpinned CLI version make the skill medium risk.