This skill is not clearly malicious, but it needs review because it presents itself as R3/Corda while documenting legal, billing, banking, payment, and permission resources plus broad authenticated action/proxy authority.
Install only after verifying that this is the intended Membrane connector and that the connection maps to the correct R3 service. Use a least-privilege account, confirm scopes and revocation options, and require explicit approval before any create, update, delete, payment, bank/account, role, permission, or raw proxy operation. VirusTotal was only pending telemetry, so the Review verdict is based on artifact-backed scope and identity ambiguity, not malware evidence.