asana-automation

SUSPICIOUS: the skill's purpose matches Asana automation, but it routes all access through a third-party hosted MCP/OAuth broker instead of direct Asana endpoints. Because the intermediary appears to be officially operated by Composio and the instructions are consistent with its docs, this is not confirmed malware; it is a medium-risk trust and data-routing concern.