jotform

SUSPICIOUS. The skill's capabilities broadly match its Jotform-integration purpose, and the npm-based CLI install is more coherent than a raw download-execute chain. The main issue is data-flow integrity: all access is mediated through ClawLink, which stores its own credential locally and appears to hold the Jotform OAuth token server-side, creating meaningful third-party trust and credential-forwarding risk even though the skill is not clearly malicious.