wappalyzer

SUSPICIOUS: The skill is mostly coherent for a Wappalyzer integration, and the Membrane CLI appears to be an official npm-distributed tool from the same org. However, the skill routes Wappalyzer access and credentials through Membrane rather than directly to Wappalyzer's official API, creating a meaningful third-party trust and data-flow concern. Combined with local token storage and unpinned `@latest` installation, this is medium security risk but not confirmed malware.