google-contacts

This JSON snippet itself is not malicious—it is a declarative launcher configuration. However, it instructs the host to execute external code via `npx -y @zapier/google-contacts-connector mcp` with no visible version pinning or integrity checking in the snippet. That makes the main concern supply-chain execution risk (unexpected package updates or tampering), rather than direct malware behavior within this file.