shippo

SUSPICIOUS: the skill's core purpose is coherent, and the install path uses an official npm package rather than an opaque binary. However, Shippo access is routed through Membrane's CLI and proxy instead of directly to Shippo official endpoints, creating intermediary credential and data-flow risk that is broader than a direct API integration. This looks more like a legitimate managed integration than malware, but the third-party proxy model raises medium security concerns.