upbooks

SUSPICIOUS: The skill is broadly coherent as a Membrane-powered UpBooks integration, and its installer comes from a legitimate registry rather than an obviously malicious source. However, it routes authentication and all operational access through Membrane instead of directly using UpBooks’ official API, creating a third-party intermediary trust and data-flow concern; combined with unpinned `@latest` CLI execution, this makes the skill medium risk rather than benign.