apache-superset

SUSPICIOUS: the skill's stated purpose is Superset integration, but all auth and API traffic are mediated by Membrane rather than going directly to Superset. The install path is reasonably verifiable through npm and vendor docs, so this is not confirmed malware, but the third-party CLI, mutable installs, and proxy-based credential/data flow make the skill medium risk.