booking-config

SUSPICIOUS. The stated Cal.com configuration purpose broadly fits the commands, but the skill’s actual footprint is not fully coherent: it relies on an unverifiable local `calcom` binary instead of Cal.com’s documented official CLI, extracts a real API key from 1Password, and sets up webhook delivery to an unverified external relay. Official Cal.com API usage lowers concern somewhat, but the combined supply-chain and credential/data-flow issues make this medium-high risk rather than benign.