Google Tasks
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: google-tasks-api Version: 1.0.5 The skill provides a managed OAuth integration for the Google Tasks API via the Maton.ai service. It includes comprehensive documentation for CRUD operations on tasks and task lists, connection management, and safety instructions requiring user approval for write operations. No malicious patterns such as data exfiltration, unauthorized execution, or prompt injection were found in SKILL.md or _meta.json. The use of a third-party proxy (api.maton.ai) is clearly disclosed as the intended functionality for managed authentication.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If approved, the agent can change or delete Google Tasks data in the connected account.
The skill exposes create, update, and delete operations, but it also states they are scoped to Google Tasks and require confirmation before execution.
Access is scoped to task lists and tasks with full CRUD operations within the connected Google Tasks account. ... All write operations require explicit user approval.
Approve only specific, intended write or delete actions, and verify the target task list or task before allowing changes.
The connected account’s task lists and tasks can be accessed through the skill according to the authorized OAuth permissions.
The skill requires a Maton API key and a Google Tasks OAuth connection, giving delegated access to the connected Google Tasks account.
Set your API key as `MATON_API_KEY` ... Open the returned `url` in a browser to complete OAuth authorization.
Use the intended Google account, keep API keys and connection URLs private, and revoke/delete connections you no longer need.
Your task data and API requests may pass through Maton before reaching Google Tasks.
Google Tasks requests flow through Maton’s API gateway, so task data and authorization handling depend on that third-party service.
Maton proxies requests to `tasks.googleapis.com` and automatically injects your OAuth token.
Install only if you trust Maton to proxy Google Tasks requests and manage OAuth tokens for this account.
Installing the CLI adds external software to your environment.
The skill is instruction-only but suggests installing an external CLI package, which is normal for the documented workflow yet outside the provided artifact scan.
npm install -g @maton-ai/cli ... brew install maton-ai/cli/maton
Verify the Maton CLI package and Homebrew tap before installing, and prefer official documentation or trusted package sources.