google-direct-oauth

SUSPICIOUS. The skill is broadly coherent with direct Google OAuth use and relies on official Google setup pages, so it does not look overtly malicious. But its actual footprint exceeds the simple Gmail/Calendar framing: it stores long-lived secrets locally, creates a persistent refresh service, routes the OAuth callback through an unspecified Zo site, and encourages broader API enablement plus credential reuse by other tools. Those trust and scope gaps make it medium risk rather than benign.