sage-hr

The Sage HR skill appears coherent with its stated purpose: it uses Membrane’s authentication flow and CLI-driven actions to manage Sage HR data via a controlled proxy, avoiding local credential storage. The data flows are centralized through Membrane, reducing exposure, and there are no evident dangerous download-execute patterns or unverifiable binaries. The footprint is proportionate to a developer-focused HRIS integration tool. Some minor transparency gaps exist around data retention and logging policies, but nothing suggests malicious or oversized permission requirements. Overall, the risk is low to moderate (benign), given appropriate trust in Membrane’s security model.