grafbase

SUSPICIOUS: The skill is coherent in purpose and uses an official npm-published Membrane CLI, so it is not malware-like. However, it introduces a third-party mediation layer for Grafbase auth and data flow, plus an unpinned CLI install, making the trust model noticeably broader than a direct Grafbase integration.