hologram

SUSPICIOUS: the skill's stated purpose is Hologram integration, but it requires a third-party Membrane CLI/service to mediate authentication and all API requests. The npm install path itself is relatively normal, so this is not confirmed malware, but the credential and data routing are broader than necessary for a simple Hologram skill and create medium security risk.