Zoho Desk

ReviewAudited by ClawScan on May 10, 2026.

Overview

This appears to be a coherent Zoho Desk integration, but it relies on Membrane/OAuth and can read or change Zoho Desk business records.

Install this only if you want Membrane to connect to Zoho Desk on your behalf. Verify the Membrane CLI package before installing it, use the least-privileged Zoho account practical, and require confirmation before creating or updating important support records.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used carelessly, the agent could change support tickets, contacts, accounts, or related Zoho Desk data.

Why it was flagged

The skill documents actions that can create and update Zoho Desk records. This matches the integration purpose, but these are business-data mutations.

Skill content
| Create Ticket | create-ticket | Create a new ticket in Zoho Desk | ... | Update Ticket | update-ticket | Update an existing ticket in Zoho Desk |
Recommendation

Use the skill for explicit user-requested changes only, and confirm important create/update operations before running them.

What this means

Installing and using this skill can grant Membrane-mediated access to the user's Zoho Desk account and keep that access usable through refresh handling.

Why it was flagged

The skill requires delegated authentication through Membrane and indicates that credential refresh is handled automatically.

Skill content
Membrane handles authentication and credentials refresh automatically ... membrane login --tenant --clientName=<agentType>
Recommendation

Authenticate only with an intended Zoho/Membrane account, prefer least-privilege access where available, and revoke the connection when no longer needed.

What this means

The behavior of the external CLI could change with future package releases, and the package code was not included in this skill artifact.

Why it was flagged

The setup uses a globally installed npm package pinned to @latest, so the installed code may change over time and is outside the provided instruction-only artifact.

Skill content
npm install -g @membranehq/cli@latest
Recommendation

Verify the npm package source before installing and consider pinning a specific trusted CLI version.

What this means

Zoho Desk support data and action results may pass through the Membrane service as part of normal use.

Why it was flagged

Zoho Desk requests and responses are mediated through Membrane rather than a direct local-only workflow.

Skill content
This skill uses the Membrane CLI to interact with Zoho Desk.
Recommendation

Use this only if your organization is comfortable with Membrane brokering the Zoho Desk integration and review Membrane's access controls and data handling.