workday-soap

SUSPICIOUS: the skill is coherent as a Membrane-published Workday integration, and the CLI install path is legitimate, but it routes authentication and Workday data through Membrane as a third-party intermediary instead of direct official Workday API use. That makes the main risk data-flow and credential/session concentration, not confirmed malware.