notarize

SUSPICIOUS. The skill’s purpose and capabilities are broadly aligned, and the CLI comes from an official npm package rather than a raw download. However, all Notarize access is funneled through Membrane as a third-party intermediary, with mutable `@latest` installation and dynamic action creation increasing trust and data-flow risk beyond a direct vendor integration.