Veracode

This skill is coherent: it uses Membrane (a third-party service) to access Veracode and does not ask for local secrets. Before installing/using it: 1) Verify you trust Membrane (review https://getmembrane.com, their privacy/TOS, and the @membranehq/cli npm package and GitHub repo). 2) Prefer least-privilege: create a dedicated Veracode connection with minimal scopes rather than using highly privileged accounts. 3) Be aware npm install -g runs third-party code — inspect the package if you need high assurance. 4) When using the 'membrane request' proxy, avoid sending any sensitive data through it unless you trust Membrane's handling of that data. 5) If you need stricter guarantees, consider using Veracode’s official APIs directly with controlled credentials instead of a third-party proxy.