clockify

SUSPICIOUS: The skill's purpose matches Clockify integration, and the installer appears to be the publisher's official npm package, so this is not confirmed malware. However, all authentication and API traffic are routed through the third-party Membrane CLI/service instead of directly to Clockify's official API, creating meaningful credential and data-flow trust concerns disproportionate to a simple Clockify connector.