plextrac

SUSPICIOUS: the skill’s purpose broadly matches its capabilities, and the CLI source appears official, but the actual data flow is agent -> Membrane -> PlexTrac rather than direct PlexTrac API use. Requiring a Membrane account, storing third-party credentials server-side, and routing actions through a separate platform are proportionate to Membrane’s integration model but create a nontrivial trust and privacy boundary; combined with mutable `@latest` installs, this makes the skill medium risk rather than benign.