Zoho

Interact with Zoho CRM, Projects, and Meeting APIs. Use when managing deals, contacts, leads, tasks, projects, milestones, meeting recordings, or any Zoho wo...

This skill appears to implement the claimed Zoho features, but there are several packaging/metadata mismatches you should address before use: 1) The registry metadata claims no required env vars or binaries, but SKILL.md and skill.json require Zoho credentials (client ID/secret/refresh token) and an optional GEMINI_API_KEY; the agent will need those secrets in a .env file in the skill directory. 2) The scripts call external programs (curl, jq, ffmpeg, base64, stat) and a local CLI bin/zoho; verify those tools exist and that the bin/zoho executable is present and trustworthy (the manifest does not include bin/zoho). 3) The standup summarizer will upload meeting audio to Google's Generative Language API when GEMINI_API_KEY is set — if you do not want recordings sent to a third party, do not set GEMINI_API_KEY or disable the summarizer. 4) Inspect the referenced repository (https://github.com/shreefentsar/clawdbot-zoho) and confirm the missing files and the bin/zoho implementation match your security requirements. 5) Run the skill in an isolated environment or test account first, and consider restricting the skill's access to only the Zoho scopes you need. If you want me to, I can list the exact lines where external endpoints are called, enumerate the runtime binaries the scripts need, or check whether the upstream repo contains the missing bin/zoho.

Type: OpenClaw Skill Name: zoho Version: 2.0.2 The skill is classified as suspicious due to its broad API permissions and the explicit instruction to send potentially sensitive meeting audio recordings to the Google Gemini API for transcription, as detailed in `SKILL.md`, `README.md`, and `scripts/standup-summarizer.sh`. While this functionality is openly declared and requires the user's `GEMINI_API_KEY`, the act of transmitting private meeting content to a third-party service represents a significant data privacy and exfiltration risk if not fully understood or consented to by the user. Additionally, the `zoho raw GET` command in `SKILL.md` allows the AI agent to make arbitrary API calls within the granted broad scopes, increasing the potential attack surface.