piwik-pro

SUSPICIOUS: the skill is mostly coherent with its stated purpose and uses an official npm-distributed CLI from the same publisher ecosystem, so it does not look overtly malicious. However, it routes Piwik PRO access and credential handling through Membrane as an intermediary proxy/service rather than directly to official Piwik PRO APIs, which creates moderate trust and data-flow risk. Overall this is a legitimate-looking third-party integration skill with medium security risk, not confirmed malware.