chartiq

SUSPICIOUS: the skill is mostly coherent as a Membrane-based ChartIQ integration guide, and the install source appears official. The main concern is data-flow integrity and trust expansion: instead of using official ChartIQ APIs directly, the skill routes authentication, action execution, and proxy requests through Membrane's CLI/service, giving a third party visibility and control over access. The mutable @latest install pattern adds moderate supply-chain risk, but there is not enough evidence of outright malware.