calendly-automation

SUSPICIOUS. The skill's Calendly capabilities fit its stated purpose, but its trust boundary is broader than expected because authentication and API operations are routed through the third-party Rube/Composio MCP instead of Calendly's first-party MCP/API path. The main risk is third-party credential/data handling plus live administrative actions, not clear malware or deception.