calendly

SUSPICIOUS. The purpose is coherent for a Calendly integration, and the described API/auth flows match Calendly’s product model, but the skill’s actual trust boundary is an unverifiable local `calendly` CLI plus undocumented shared helpers that handle OAuth tokens. Because that binary is not tied to a verifiable official Calendly distribution path and it receives credentials/tokens, the skill carries high supply-chain and credential-forwarding risk despite otherwise proportionate functionality.