zoho-inventory

SUSPICIOUS: the skill's purpose and capabilities mostly align, and the npm CLI appears same-org and publicly sourced, but the integration routes Zoho access through ClawLink as a third-party intermediary that stores OAuth tokens and receives business data/action requests. This is a coherent SaaS integration pattern, not confirmed malware, yet it expands trust and write authority beyond Zoho's official direct API path.