lookml

SUSPICIOUS: the skill’s purpose is plausible and the installer is from an official npm package, but the actual integration is mediated by Membrane rather than direct Looker APIs. That third-party brokering of authentication and API traffic is a notable data-flow and credential-forwarding concern, amplified by mutable `@latest` installs, though not enough to indicate confirmed malware.