Zoho Calendar
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a coherent Zoho Calendar connector, but it needs a Maton API key/OAuth connection that can read and change calendar data.
Use this skill only if you trust Maton with your Zoho Calendar access. Keep MATON_API_KEY private, confirm every create/update/delete action before it runs, specify the intended connection when multiple accounts exist, and revoke unused OAuth connections.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone with the API key or active connection could potentially access or act on the connected Zoho Calendar through Maton.
The skill requires a Maton API key and uses managed OAuth to access the user's Zoho Calendar account. This is expected for the integration, but it is sensitive delegated account access.
All requests require the Maton API key in the Authorization header ... Maton proxies requests to `calendar.zoho.com/api/v1` and automatically injects your OAuth token.
Keep MATON_API_KEY private, revoke it if exposed, and use the Maton-Connection header when multiple accounts are connected.
Mistaken approvals could change calendars, delete events, or send scheduling updates/invitations.
The skill can create, update, and delete calendar resources. The artifacts include an approval requirement, so this is purpose-aligned but still high-impact functionality.
Manage calendars and events with full CRUD operations ... All write operations require explicit user approval.
Before approving any write action, verify the exact calendar, event, attendees, recurrence settings, and intended result.
Calendar details, event metadata, and scheduling changes may be visible to or processed by the Maton service.
Calendar API calls and returned calendar data flow through Maton as a third-party proxy before reaching Zoho. This is disclosed and purpose-aligned.
Base URL ... `https://api.maton.ai/zoho-calendar/api/v1/{endpoint}` ... Maton proxies requests to `calendar.zoho.com/api/v1`.Use this skill only if you trust Maton's handling of calendar data and OAuth connections.
It is harder to independently verify the publisher or service implementation from the registry entry alone.
The registry does not provide a source repository or homepage, though the skill is instruction-only and does not install code. This is a provenance note rather than evidence of hidden behavior.
Source: unknown; Homepage: none; Install specifications: No install spec — this is an instruction-only skill.
Verify that you trust Maton and the listed registry owner before connecting a Zoho Calendar account.