complianceai

SUSPICIOUS. The skill is mostly coherent for a Membrane-mediated Compliance.ai integration, and the CLI comes from an official npm package rather than an unverifiable binary. However, it routes authentication and data through a third-party intermediary instead of the official Compliance.ai API, understates that intermediary role, contains a false claim about public Compliance.ai docs, and uses an unpinned CLI install. This looks like a legitimate integration with medium security risk, not confirmed malware.