google-appsheet

SUSPICIOUS: The skill's capabilities mostly match its stated AppSheet purpose, and the CLI install path appears to be the official npm-distributed Membrane tool. However, all API access and authentication are funneled through Membrane rather than directly to Google AppSheet, and the proxy mode can send requests to arbitrary full URLs. This creates meaningful third-party data-flow and trust expansion risk, though there is no clear evidence of outright malware or credential theft instructions.