chatwoot

SUSPICIOUS: the skill is coherent as a Chatwoot integration, and the CLI install source appears official, but it routes authentication and API access through Membrane instead of directly to Chatwoot. That extra intermediary and server-side credential handling make the scope and data flow moderately risky, though not clearly malicious.