kong

SUSPICIOUS. The skill's purpose and capabilities mostly align, but it relies on a third-party Membrane CLI and service to authenticate, proxy, and manage Kong interactions instead of using Kong's official direct APIs/tools. The installer appears legitimate and documented, so this is not confirmed malware, but the intermediary credential/data flow and mutable npm/npx execution make it a medium-risk integration skill.