calendar-sync-helper

SUSPICIOUS: the stated purpose is plausible, but the skill omits critical details about authentication and directs sync traffic to an unspecified configurable endpoint instead of explicitly to official Google Calendar API endpoints. The footprint is not overtly malicious, but the unverified data flow prevents a benign classification.

The configuration contains a supply-chain and credential-routing concern because OAuth callback traffic is directed to a public ngrok tunnel domain. This warrants verification of domain ownership, tunnel destination, token handling, and OAuth redirect configuration. No direct malware or executable malicious behavior is present in this fragment.