docusign

SUSPICIOUS. The skill’s capabilities broadly match its DocuSign automation purpose, and the CLI install path appears legitimate. The main concern is architectural: it routes authentication and DocuSign operations through Membrane as an intermediary, which is proportionate to the product but increases trust and data-flow risk versus direct DocuSign API use; combined with unpinned global CLI install and high-impact actions, this makes the skill medium risk rather than benign.