timely-time-tracking

SUSPICIOUS: The skill's purpose and capabilities are mostly aligned, and the CLI install path appears to be official same-org npm distribution rather than a covert payload. The main concern is data-flow integrity: Timely authentication and API access are routed through Membrane as an intermediary, so account access and workflow data are mediated by a third party rather than sent directly to Timely. Overall this looks like a legitimate integration with medium trust and proxying risk, not confirmed malware.