snyk

SUSPICIOUS. The skill is internally coherent as a Membrane-based Snyk connector, and the CLI install path is from an official npm package, so this is not confirmed malware. However, the skill’s real footprint routes Snyk authentication and API traffic through Membrane rather than directly to official Snyk endpoints, creating a third-party credential/data mediation risk that is significant for an AI-agent skill.