Howtoletmyagent Secure Gmail Access
v0.1.0Teach an OpenClaw agent the recommended Gmail OAuth2 setup, scope choices, and safety guardrails from this guide.
⭐ 0· 88·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name and description match the SKILL.md: the skill is a companion guide that references a specific article and explains Gmail OAuth2 setup, scope choices, and guardrails. It does not request unrelated binaries, config paths, or credentials.
Instruction Scope
The instructions are aligned to the referenced article and correctly emphasize calling out risks and approvals. However the guidance includes open-ended phrases like "inspect first and adapt carefully" and "perform the workflow end-to-end if the user asks," which give the agent broad discretion. The SKILL.md does not explicitly instruct reading local files or exfiltrating secrets, but the vagueness could lead the agent to ask for or attempt to use sensitive credentials if the user requests full automation.
Install Mechanism
No install spec and no code files — instruction-only. This is the lowest-risk install model and consistent with a documentation/guide skill.
Credentials
The skill declares no required environment variables, no primary credential, and no config paths. That is proportionate for a guidance-only skill. Note: performing real OAuth operations would require client credentials in practice, but the skill itself does not request them.
Persistence & Privilege
always:false and user-invocable:true (default) — appropriate for a teaching/guide skill. The skill does not request permanent presence or modify other skills or system-wide agent settings.
Assessment
This skill is a text-only guide on how to set up Gmail OAuth2 and is coherent with that purpose. Before installing or asking the agent to perform changes: (1) verify the source article yourself; (2) do not paste client_secret, private keys, or admin credentials into chat — instead follow step-by-step instructions locally or provide the agent with only the minimum, short-lived tokens if absolutely necessary; (3) prefer least-privilege OAuth scopes and internal/verified consent where possible; (4) if you want the agent to perform actions in your cloud/GCP project, expect it to request credentials — consider doing those steps yourself or creating a scoped, revocable credential for the task; (5) audit and rotate any credentials created. If you want a stricter assessment, provide the referenced article or examples of prompts where the agent would be asked to act autonomously so I can check for additional risky guidance.Like a lobster shell, security has layers — review code before you run it.
latestvk978b304mnts04tx0zny2a9jp583gzhs
License
MIT-0
Free to use, modify, and redistribute. No attribution required.