zoho-recruit

SUSPICIOUS. The skill's capabilities fit its stated Zoho Recruit integration purpose, and there is no malware-like installer or hidden execution. The main issue is data-flow integrity: all requests and the API key are routed through Maton-managed proxy endpoints, and the specific subdomains used by the skill do not match the public Maton API hosts cited in available docs. This is a coherent but higher-trust intermediary design, so the skill is not malicious, but it carries meaningful medium risk.