karbon

SUSPICIOUS: The skill is broadly coherent for Karbon management and uses an official-seeming Membrane CLI from npm, so it does not look malicious. However, all authenticated Karbon traffic and credential handling are routed through Membrane as a third-party proxy instead of directly to official Karbon endpoints, which creates meaningful intermediary trust and data-flow risk.