brandfetch

SUSPICIOUS: the skill's purpose is plausible, but it unnecessarily inserts Membrane as a third-party auth and API proxy instead of using Brandfetch's direct official API flow. The npm install path is legitimate and not malware-like, but the expanded trust boundary, credential handling by a separate platform, and mutable `@latest` install make this a medium-risk skill.