focalboard

SUSPICIOUS: the skill is coherent in purpose and uses a legitimate npm-distributed CLI, but it intermediates Focalboard access through Membrane rather than the official Focalboard API. That third-party credential/data routing is disclosed and product-consistent, so this is not confirmed malicious, but it creates meaningful trust and data-flow risk beyond a direct integration.