zoho-inventory

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the npx @useclawlink/cli tool to interact with Zoho Inventory services. This involves standard shell commands to log in, connect, and perform actions like reading or updating data.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx, which dynamically downloads the @useclawlink/cli package from the official NPM registry to execute it.
  • [CREDENTIALS_UNSAFE]: The documentation notes that the CLI stores session credentials locally at ~/.clawlink/credentials.json. This is standard behavior for CLI-based authentication and is not a credential exfiltration finding.
  • [DATA_EXFILTRATION]: Network operations are restricted to the vendor's own CLI and official domains (claw-link.dev) for the purpose of managing Zoho Inventory data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 02:42 PM
Security Audit — agent-trust-hub — zoho-inventory