tolgee

SUSPICIOUS. The skill’s capabilities match Tolgee management, and its install source is a legitimate npm package from the same vendor ecosystem, so this is not overt malware. However, it shifts all Tolgee access and authentication through Membrane instead of Tolgee’s direct API flow, creating notable credential-forwarding and intermediary data-flow risk that is broader than a simple Tolgee integration.