mercado-libre

SUSPICIOUS: the skill is broadly coherent for Mercado Libre integration, and its install path is official npm rather than an opaque binary. However, all API access and authentication are funneled through Membrane as a third-party intermediary, and the skill encourages mutable @latest CLI execution. This is not confirmed malware, but it creates medium trust and credential-forwarding risk beyond a direct Mercado Libre integration.