sellercloud

SUSPICIOUS: The skill’s purpose is plausible, and the CLI comes from an official npm scope, so this is not confirmed malware. However, the skill materially expands trust from Sellercloud to Membrane by installing a third-party CLI and routing auth and API activity through Membrane-managed infrastructure rather than Sellercloud directly; combined with the unpinned global install, this creates medium security risk.