Tmp.V16Z3aLtXA
ReviewAudited by ClawScan on May 14, 2026.
Overview
The skill mostly matches Google Slides editing, but it exposes a broad authenticated run escape hatch and relies on an unreviewed npm/MCP setup.
Install only if you trust the `gogcli-mcp-slides` package and the Google account it will use. Prefer a dedicated or least-privileged Google account, pin or verify the npm package, and require confirmation before delete/replace/export actions or any `gog_slides_run` use.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An agent could use a broad command path instead of safer named Slides tools, increasing the chance of unintended account or presentation changes.
A documented run escape hatch for 'anything not covered' is not clearly bounded to the named Slides tools, and it would operate in the context of an authenticated Google account.
Plus 5 auth tools and `gog_slides_run` for anything not covered.
Use named Slides tools where possible, require explicit confirmation before any `gog_slides_run` use, and restrict the Google account or scopes used by the tool.
The agent may be able to read or modify presentations accessible to the configured Google account.
The skill depends on an already-authenticated Google/gogcli session. That is expected for managing Google Slides, but it grants the skill actions under the selected account.
- [gogcli](https://github.com/steipete/gogcli) installed and authenticated
Use a dedicated or least-privileged Google account when possible, and verify what account is set in `GOG_ACCOUNT` before use.
The behavior users get depends on the npm package resolved at setup/runtime, not code reviewed in this artifact bundle.
The setup runs an external npm package without a pinned version, while the provided artifact set contains no code files for that package.
"command": "npx", "args": ["-y", "gogcli-mcp-slides"]
Verify the npm package provenance, consider pinning a trusted version, and review the package source before configuring the MCP server.