google-calendar

SUSPICIOUS: the skill's capabilities and Google API routing are broadly consistent with a calendar connector, but its footprint includes transitive skill installation and mutable npm/npx execution paths that raise supply-chain trust concerns. Not malicious from the provided evidence, but medium risk due to install trust and its ability to make real-world calendar and sharing changes.