Zoho Mail
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code, runtime instructions, and required secrets are consistent with a Zoho Mail client that needs OAuth credentials and a local encryption key to store tokens; nothing obviously unrelated or malicious is present.
This skill appears coherent with its stated purpose, but before installing: 1) remember it has full read/write access to the linked Zoho mailbox — treat the required client credentials and ZOHO_MAIL_TOKEN_KEY as highly sensitive; 2) verify the GitHub release you download (check tags and the provided checksums) to avoid installing a tampered binary; 3) store the three secrets in a secure secrets manager and ensure the instance's .env/SSM parameters are protected from other users/processes; 4) the operator must perform an interactive OAuth login (pasting the full redirect URL) — ensure that process is done securely; 5) if you need principle-of-least-privilege, consider creating a Zoho client with minimal scopes or a dedicated mailbox account rather than using a high-privilege personal account.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.