basecamp

SUSPICIOUS. The skill's stated purpose matches its functionality, and the CLI appears to come from a plausible same-brand npm package, so this is not confirmed malware. However, it routes Basecamp access through ClawLink as a third-party intermediary that holds OAuth tokens and receives user data/actions, which is a meaningful data-flow and credential-forwarding risk for an agent skill.