Gws Licensing

Google Workspace Enterprise License Manager: Manage product licenses.

Security Scan

The skill's stated purpose (manage Google Workspace licenses via a 'gws' CLI) is plausible, but the runtime instructions rely on an external ../gws-shared/SKILL.md for authentication/security without declaring any required credentials or explaining how the 'gws' binary is obtained, which is inconsistent and could lead the agent to read or create files containing secrets.

Purpose & Capability

Name and description match the CLI commands in SKILL.md (gws licensing ...). Requiring a 'gws' binary is reasonable for a CLI-based Google Workspace tool. However, the skill does not declare any auth environment variables or a primary credential even though the instructions explicitly point to an external ../gws-shared/SKILL.md for auth and security rules — a mismatch between claimed requirements and implied needs.

Instruction Scope

The SKILL.md tells the agent to 'Read ../gws-shared/SKILL.md for auth, global flags, and security rules' and suggests running 'gws generate-skills' if missing. That directs the agent to access a relative filesystem path outside the skill, and potentially to create files. It grants no provenance for what is in that shared file (it may contain credentials or sensitive configuration), and the skill does not document which specific auth values are required.

Install Mechanism

This is an instruction-only skill with no install spec and no code to download or extract — lowest install risk. The only runtime dependency is an existing 'gws' binary on PATH; the skill does not provide or fetch that binary.

Credentials

requires.env is empty and no primary credential is declared, yet the SKILL.md implicitly depends on external authentication in ../gws-shared/SKILL.md. This lack of declared credentials is disproportionate to the expected need for Google Workspace API credentials and leaves unclear how auth is supplied, stored, or protected.

Persistence & Privilege

always is false and the skill does not request persistent system-wide changes in its instructions. The only persistence-risky instruction is the suggestion to run 'gws generate-skills' which could create files — but that is a consequence of using the gws tool, not the skill itself.

What to consider before installing

This skill plausibly wraps a 'gws' CLI for Google Workspace license management but is inconsistent about authentication. Before installing: verify the source and owner (unknown here); confirm what the 'gws' binary is and where it comes from (do not run unknown installers); ask the author to document required auth (OAuth client, service account, or specific env vars) rather than pointing to an external ../gws-shared/SKILL.md; inspect any gws-shared SKILL.md file yourself to see whether it holds credentials; avoid granting the agent broad file-system access or running 'gws generate-skills' until you know what it will create; prefer skills that declare required environment variables and a clear auth flow. If you cannot confirm those details, treat this skill as untrusted or test it in an isolated environment.

licensing (v1)

PREREQUISITE: Read ../gws-shared/SKILL.md for auth, global flags, and security rules. If missing, run gws generate-skills to create it.

gws licensing <resource> <method> [flags]

API Resources

licenseAssignments

• delete — Revoke a license.
• get — Get a specific user's license by product SKU.
• insert — Assign a license.
• listForProduct — List all users assigned licenses for a specific product SKU.
• listForProductAndSku — List all users assigned licenses for a specific product SKU.
• patch — Reassign a user's product SKU with a different SKU in the same product. This method supports patch semantics.
• update — Reassign a user's product SKU with a different SKU in the same product.

Discovering Commands

Before calling any API method, inspect it:

# Browse resources and methods
gws licensing --help

# Inspect a method's required params, types, and defaults
gws schema licensing.<resource>.<method>

Use gws schema output to build your --params and --json flags.