khoros-marketing

SUSPICIOUS. The skill's capabilities generally match its stated Khoros Marketing purpose, and the CLI comes from an official registry rather than a raw download. The main concern is architectural: authentication, credential refresh, action execution, and proxy requests are routed through Membrane, so Khoros credentials and data transit a third-party integration layer instead of only official Khoros APIs. That is disclosed and plausibly legitimate for this publisher, so this is not malicious, but it is a medium-risk trust and data-flow model with added supply-chain exposure from using an unpinned CLI.