Whistic

This skill appears to be an integration that relies on the Membrane CLI to talk to Whistic, which is coherent — but note these concerns before installing: - The SKILL.md requires installing and running the Membrane CLI (npm / npx), yet the registry metadata did not declare any required binaries; ensure you have npm/node and are comfortable running global npm installs. - Global npm installs and npx pulls execute code from the npm registry; verify the @membranehq/cli package provenance (check the official repo, audit versions, prefer pinned versions and review release notes or checksums). Avoid running `-g` installs from unknown sources if you can't verify them. - The Membrane CLI will open browser-based auth and then act with your credentials; only authorize connections you trust and review what scopes/permissions the connector requests. A compromised or malicious package could misuse those tokens. - If you need stronger assurance, request the publisher to add explicit required-binaries and an install_spec in the registry metadata, or run the CLI in a sandboxed environment first. What would change this assessment: explicit registry declarations (required binaries), pinned/verified CLI versions or signed releases, and a trustworthy repository/source for the package would move this toward benign. Conversely, discovery of instructions that access unrelated system files, ask for unrelated credentials, or reference arbitrary download URLs would increase the severity toward malicious.