timely-time-tracking

SUSPICIOUS: The skill is broadly coherent with its purpose and uses an official npm-published CLI, so it does not look malicious. However, it requires trusting Membrane as an intermediary for authentication, credential handling, and Timely data access, and it installs an unpinned global CLI; this makes it medium risk rather than benign.