clickup

SUSPICIOUS: The skill’s purpose is coherent, and the Membrane CLI install path is verifiable via npm and matching docs, so this is not malware. However, it routes ClickUp authentication and API traffic through a third-party intermediary platform, which is broader than a direct ClickUp integration and creates medium security risk from credential forwarding and indirect data access.