ZohoProject

Manage Zoho Projects — list portals/projects, create/update/complete tasks, add comments, log time, manage milestones, and query your task list. Requires ZOH...

This skill appears to do exactly what it says: call Zoho Projects APIs using the provided ZOHO_ACCESS_TOKEN and ZOHO_PORTAL_ID. Before installing: 1) Be comfortable with the agent storing the refreshed access token in its config (it writes to skills.entries.zoho-projects) — ensure that storage location is acceptable and access to the agent config is restricted. 2) Prefer providing only the minimal OAuth scopes and avoid supplying client_secret/refresh_token unless you want the skill to auto-refresh tokens. 3) Remember tokens expire hourly; if you do supply refresh credentials, they are sensitive and should be rotated if the skill is removed. 4) If you do not want the skill to call Zoho APIs autonomously, disable/limit autonomous invocation in your agent settings. Overall the skill is internally consistent with its stated purpose.

Type: OpenClaw Skill Name: zohoproject Version: 1.0.0 The skill bundle provides a standard integration for managing Zoho Projects via its REST API. It includes instructions for authentication, token refreshing, and various CRUD operations for projects, tasks, and milestones using curl commands. While it contains specific instructions regarding project IDs for certain domains (sarvahealth.ai, Katprotech) and uses a future-dated timestamp (2026) in its metadata and examples, there is no evidence of malicious intent, data exfiltration, or unauthorized execution. The use of 'openclaw config set' is a legitimate mechanism for the agent to persist refreshed OAuth tokens.