linear

SUSPICIOUS: The skill’s capabilities fit a Linear integration, and the npm install path appears consistent with Membrane’s published CLI. However, the actual data flow is not direct to Linear: authentication and API access are mediated by Membrane, a third-party service/CLI, which broadens trust and gives that intermediary access to tokens and Linear data. This is a coherent integration pattern, not confirmed malware, but it carries medium risk due to third-party credential/data handling and an unpinned `@latest` CLI install.