zoho-calendar

Warn

Audited by Socket on Sep 4, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

SUSPICIOUS: the skill's purpose matches calendar management, and there is no malware-style installer or executable payload. However, it requires a third-party Maton API key and routes Zoho Calendar data and auth through Maton-operated proxy endpoints rather than directly to Zoho, with endpoint hostnames that are not the main publicly documented API base; this makes the trust boundary and credential/data flow broader than a direct Zoho integration.

Confidence: 87%Severity: 58%
Audit Metadata
Analyzed At
Sep 4, 2026, 01:53 PM
Package URL
pkg:socket/skills-sh/craftos-dev%2Fcraftbot%2Fzoho-calendar%2F@c189ba7768408d04a0b7b61e0bd5aa3bb3dd66b4a1446567645aa63951682f8c
Security Audit — socket — zoho-calendar