monday-brief

SUSPICIOUS. The stated purpose is plausible, but the actual footprint is broad: sensitive multi-system data access, file export, optional channel posting, scheduling, and an unexplained transitive dependency on `business-pulse`. The main concern is not confirmed malware, but unclear trust and data-flow boundaries for the referenced downstream skill plus unnecessary execution capability (`Bash`) for a reporting workflow.