data-upload-java-cli

SUSPICIOUS. The purpose and Domo-focused actions are coherent, but the skill’s core dependency is an unverifiable local JAR that directly receives a Domo API token. That makes the main risk supply-chain and credential-forwarding, not confirmed malware.