coda-automation

SUSPICIOUS: The skill’s core capabilities match Coda automation, and the Composio/Rube relationship appears legitimate, so it is not strong malware evidence. However, setup claims are inconsistent with official docs, and all document data and auth flows are mediated through a third-party MCP layer that can read or act on sensitive Coda content; combined with publish/share actions, this makes the skill medium risk.