showpad

SUSPICIOUS: the skill's purpose is Showpad integration, but all authentication and API operations are brokered through Membrane instead of Showpad's official endpoints. The install path is relatively normal via npm, and scope is not obviously excessive, but the intermediary data flow and delegated credential handling make this a medium-risk third-party access pattern rather than a clean direct integration.