supernotes

SUSPICIOUS: The skill’s functionality is mostly aligned with its purpose, and the CLI install path is from an official npm package tied to the publisher. However, all Supernotes access and token handling are mediated through Membrane rather than direct official Supernotes APIs, adding a third-party trust boundary and credential/data routing layer that is not strictly necessary for this task. This looks more like a managed integration platform than outright malware, but the intermediary architecture raises medium security risk.