proofpoint

SUSPICIOUS: the skill's capabilities mostly match its stated Proofpoint purpose, and the install path is from an official npm package rather than an obviously malicious source. However, the core workflow routes Proofpoint auth and API traffic through Membrane instead of direct Proofpoint endpoints, creating third-party credential/data mediation that is broader than a simple vendor integration guide.