docebo

SUSPICIOUS: the skill's purpose and capabilities generally align, and the CLI install path appears to be the publisher's official npm distribution. However, the skill requires trust in Membrane as an intermediary for authentication and API traffic, and it explicitly proxies Docebo requests through Membrane rather than calling Docebo directly. That makes the footprint broader than a direct Docebo integration, with medium data-flow and third-party trust risk but not clear malicious intent.