squarespace

SUSPICIOUS: the skill's stated purpose fits its capabilities, and the CLI install path appears official and documented. However, it requires trusting a third-party integration platform to broker Squarespace authentication and API traffic, so data and credentials flow through Membrane rather than directly to Squarespace; combined with unpinned `@latest` CLI execution, this creates medium security risk without clear evidence of malware.