integrate-anything

SUSPICIOUS. The skill is internally consistent about using Membrane as an integration broker, and its install path appears to be official npm tooling rather than a fake installer. However, its core design requires all third-party app traffic, auth context, and action data to flow through Membrane instead of official vendor APIs, giving a single external service broad access across many apps. That proxy-centric data flow and high-action scope are disproportionate enough to rate as medium-high security risk even without clear malware indicators.