joule-cli

SUSPICIOUS: overall footprint mostly matches a legitimate SAP Joule CLI skill, and network/data flows appear to target official SAP services. The main concern is install-trust inconsistency: the skill names a package that does not match SAP's current documented package, plus it handles sensitive credentials and offers insecure local storage. This looks more like a possibly outdated or inaccurate skill than malware, but the package-name mismatch is significant enough to avoid a benign verdict.