zoho-forms

SUSPICIOUS: the skill's stated Zoho Forms purpose is plausible, and the CLI comes from an official npm package, so this is not confirmed malware. But the skill unnecessarily routes authentication and API traffic through Membrane rather than Zoho's official API, making credentials and data flow through a third-party intermediary; combined with mutable @latest installs, this creates medium security risk and weakens purpose/data-flow integrity.