enterprise-user-management-ai-analytics

SUSPICIOUS: the app capabilities mostly match the stated purpose, and data flows are local and proportionate, but the install path is not coherent with the claimed publisher. Because the skill branded by ara.so instructs users to clone and execute an unrelated personal GitHub repository with npm/pip dependencies and no same-org release verification, the primary risk is supply-chain trust rather than confirmed malware.