0codekit

SUSPICIOUS: the skill’s core behavior is coherent with its stated purpose, and its install path uses an official npm package rather than an unverifiable binary. However, it routes access through Membrane as an intermediary, uses a mutable global CLI install, and enables broad remote action execution against many data types, so the overall risk is medium rather than benign.