coupa-automation

SUSPICIOUS: the skill's core purpose is plausible, but its setup and trust model are inconsistent with current official evidence. It routes Coupa access through a third-party integration layer, references a seemingly discontinued Rube MCP endpoint, and claims 'no API keys needed' despite official docs showing more controlled session/API-key flows; this is more a trust and data-flow mismatch than confirmed malware.