gcal-pro - Google Calendar
v1.0.0Google Calendar integration for viewing, creating, and managing calendar events. Use when the user asks about their schedule, wants to add/edit/delete events, check availability, or needs a morning brief. Supports natural language like "What's on my calendar tomorrow?" or "Schedule lunch with Alex at noon Friday." Free tier provides read access; Pro tier ($12) adds create/edit/delete and morning briefs.
⭐ 3· 2.6k·4 current·5 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Google Calendar integration) match the delivered files and behavior: OAuth setup, calendar read/write via Google Calendar API, and a local license. No unrelated services, credentials, or binaries are requested.
Instruction Scope
SKILL.md instructs the agent and user to run included Python scripts, perform OAuth via a local browser flow, and store credentials in ~/.config/gcal-pro. It confines actions to calendar operations and license checks and explicitly requires user confirmation for destructive operations.
Install Mechanism
There is no install script that downloads arbitrary code; all source files are included in the bundle and dependencies are listed in requirements.txt (Google auth & API libs). No remote URL installation or archive extraction is used.
Credentials
The skill requests no environment variables and stores data in ~/.config/gcal-pro. The license module reads hostname and USER/USERNAME to create a machine id — this is proportional to a local license mechanism, though it’s privacy-relevant metadata. No unrelated secrets or cloud credentials are requested by the skill itself (user must supply client_secret.json from Google).
Persistence & Privilege
always:false and the skill stores token.json and license.json only under the user's config directory. It does not request global/system-wide changes or adjust other skills' configurations. It runs a local OAuth callback server (run_local_server on port 8080) which is expected for desktop OAuth flows.
Assessment
What to consider before installing:
- Functional summary: This is a Google Calendar integration that needs you to create a Google Cloud OAuth client and save client_secret.json to ~/.config/gcal-pro; it stores token.json (access/refresh tokens) and license.json (Pro flag) there.
- Privacy & security: The skill will be able to read (free tier) and, if you activate Pro, create/edit/delete events. Only activate Pro if you trust the skill and the license key mechanism. Do not commit client_secret.json or token.json to source control.
- OAuth behavior: Authentication runs a local webserver (opens your browser and listens on port 8080) — this is normal for InstalledAppFlow but be aware of the temporary local listener.
- Dependencies: Install with pip install -r requirements.txt. The code dynamically uses requests in revoke logic but requests isn't listed; ensure your environment includes requests if you plan to use revoke.
- Confirmation safeguards: The code prints a confirmation prompt for destructive actions; verify prompts are presented before allowing the skill to act on your calendar.
- Review & provenance: The package includes placeholder links/contacts (gumroad-link, [your-email]). The source/origin is unknown — if you need higher assurance, review the included Python scripts yourself or prefer a skill from a known publisher.
- If you install: keep client_secret.json and token.json private, inspect scripts for any modifications, and grant only the scopes you are comfortable with (calendar.readonly vs calendar.events).
Overall this skill appears coherent with its stated purpose; no unexpected network endpoints or broad credential requests were found.Like a lobster shell, security has layers — review code before you run it.
latestvk97a4w5b95vy4zn9ewtkt6ejbx7zzvr0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.