quickmailio

SUSPICIOUS: the skill is purpose-aligned and uses an official-looking npm CLI, but it routes authentication and API traffic through Membrane instead of directly to QuickMail.io. That intermediary data flow and unpinned CLI execution create medium security risk, though there is not enough evidence to call it malicious.