oceinteg

SUSPICIOUS: the skill’s behavior is largely consistent with a real enterprise integration acceptance workflow, and I found no clear malware, hidden exfiltration endpoint, or deceptive installer. However, it has a high-impact footprint: it retrieves and binds multiple sensitive credentials, exports a private key to disk, and performs real-world actions across Slack, GitHub, Linear, Kubernetes, and cloud environments. That breadth is plausible for the stated purpose but still medium risk due to the concentration of privileged access and live side effects.