placetel

SUSPICIOUS. The skill’s purpose and capabilities are broadly aligned, and the CLI install path is an official npm-based distribution rather than a raw payload. The main concern is data-flow integrity and trust expansion: all Placetel access and credential lifecycle handling are mediated by Membrane, a third-party proxy layer, instead of direct first-party API use. This is not confirmed malware, but it creates medium security risk because business data and auth tokens flow through an intermediary service and an external CLI installed at `@latest`.