google-calendar

SUSPICIOUS: The skill’s capabilities match its stated Google Calendar purpose, and install sources appear same-ecosystem and official. The main risk is architectural: sensitive calendar data and OAuth-backed actions are mediated through AgentPMT-hosted remote services, plus the skill asks to install companion skills, creating transitive trust. This is coherent but medium-risk due to third-party data handling and real-world action capability, not clear malware.