ninox

SUSPICIOUS: the skill is coherent as a Membrane-powered Ninox connector, but its real footprint is broader than a plain Ninox integration because authentication, credentials, and data access are mediated by Membrane. Install provenance is reasonably legitimate via npm, so this is not confirmed malware, but the third-party gateway model and unpinned CLI install create meaningful medium risk.