dailybot

SUSPICIOUS: the skill’s purpose and capabilities broadly align, and the CLI comes from an official same-vendor npm package, so this is not strong malware evidence. However, the integration routes DailyBot access through Membrane instead of DailyBot directly, creating third-party credential/data mediation, and it exposes high-impact actions like sending emails/messages and inviting users without explicit per-action safety constraints.