mattermost

SUSPICIOUS. The core purpose is plausible, and the npm install path is legitimate, but the skill's actual data flow relies on a third-party intermediary (Membrane) for authentication, credential refresh, and proxying Mattermost API requests instead of using Mattermost directly. That makes the footprint broader than a straightforward Mattermost integration and raises medium risk, though not enough to indicate confirmed malware.