Endorsal

This skill appears to do what it says (talk to Endorsal via Membrane), but there are a few things to weigh before installing: - The SKILL.md depends on the Membrane CLI and instructs running npx @membranehq/cli@latest. npx will fetch and run code from npm at runtime; consider installing a vetted/pinned version of the CLI yourself instead of relying on 'npx ...@latest'. - The documentation says credentials are stored at ~/.membrane/credentials.json, but the skill manifest does not declare that config path. Expect the Membrane CLI to create/read that file; check its contents and filesystem permissions. - The Membrane proxy supports passing a full URL; if misused, that could cause authenticated requests (with Membrane-managed tokens) to be sent to unexpected endpoints. Avoid using free-form full-URL proxying unless you trust the target and understand what headers and tokens will be attached. - If you decide to use this skill: verify the authenticity of @membranehq/cli on npm, prefer pinning to a specific version, review the credential file after login, and do not paste tokens or secrets into chat. If you need stronger assurance, ask the skill author to declare the config path and to provide an install spec that pins the CLI release. Given these mismatches and runtime risks, treat the skill as suspicious until you confirm the Membrane CLI behavior and where credentials are stored and used.