zoho

SUSPICIOUS: the install path appears same-org and not overtly malicious, but the skill's core model is a third-party gateway that stores its own credential locally and mediates all Zoho access through ClawLink instead of direct Zoho APIs. That data-flow design is broader and riskier than a typical service-specific integration, so the skill is internally coherent but trust-heavy and medium/high risk.