announcekit

SUSPICIOUS. The skill’s stated purpose matches its AnnounceKit management capabilities, and the npm-distributed CLI appears to be an official Membrane tool rather than a random payload. However, all authentication and API access are funneled through Membrane instead of AnnounceKit’s official endpoints, expanding trust and data exposure to an intermediary service. This is disclosed and somewhat proportionate, so it is not malicious, but the third-party mediation and unpinned CLI dependency make it medium risk.