Back to plugin

Security audit

GWS Gmail Watcher

Security checks for vulnerabilities and agentic risk

Overview

This appears to do what it claims—watch Gmail through the local gws CLI and deliver email previews to OpenClaw—though its registry metadata understates the local tools it needs.

Install this only if you are comfortable granting the Google Workspace CLI access to your Gmail account and having new-email sender, subject, and snippet information delivered to your OpenClaw agent and logged by the plugin. The subprocess behavior is expected for this design, but verify you install the official `@googleworkspace/cli`/`gcloud` tools and that your PATH does not point `gws` or `openclaw` to an untrusted binary. The empty required-binaries/env metadata is incomplete, so rely on the README setup steps rather than the registry requirements alone.

SkillSpector findings are pending for this release.

Endor dependency reachability

Checked Nov 7, 2026 · 7:39 AM UTC

No reachable vulnerabilities reported

Endor dependency scan completed.