liferay

SUSPICIOUS: The skill’s purpose is coherent, and the install path is an official npm package rather than a raw payload, so this is not confirmed malware. However, the integration relies on a third-party CLI and routes authenticated Liferay access through Membrane infrastructure instead of directly to Liferay, making credential/data flow broader than the stated single-service purpose; combined with unpinned @latest installs, this is medium risk.