zip-archive-api

SUSPICIOUS. The skill's general purpose is plausible, and the Membrane CLI appears to be an official npm-distributed tool, so this is not confirmed malware. However, the integration is materially routed through Membrane as a third-party intermediary rather than directly to the named Archive API, and the documentation misstates the official API docs. Combined with unpinned @latest installs, this creates moderate trust and data-flow risk disproportionate to a simple API integration.