traceable

SUSPICIOUS. The skill's stated purpose is Traceable integration, but it routes authentication and API access through third-party Membrane instead of Traceable's official API path. The npm install source is legitimate, so this is not confirmed malware, but the intermediary data flow, global CLI dependency, and mutable `@latest` installs make the skill higher risk than a direct Traceable integration.