thoughtful-gpt

SUSPICIOUS: the skill is broadly coherent as a Membrane integration, and the CLI install source appears legitimate, but the actual data flow relies on Membrane as an intermediary for authentication and API access to a service with no cited official developer documentation. That mismatch and proxy-based request model create medium security risk even without clear evidence of malware.