Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Gws Script
v1.0.2Manage Google Apps Script projects.
⭐ 0· 108·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description and the listed gws CLI commands match the stated purpose (managing Apps Script). Requiring the 'gws' binary is reasonable. However, the skill does not declare any credentials or config paths even though Apps Script management normally requires Google OAuth/service-account credentials or tooling (gcloud/ADC). That omission is unexpected.
Instruction Scope
The runtime instructions explicitly tell the agent to read '../gws-shared/SKILL.md' for auth, global flags, and security rules, or to run 'gws generate-skills' to create it. That requires reading a relative file outside this skill bundle (an undeclared external dependency). The instructions do not document what auth artifacts are used or where credentials are stored, which gives the agent broad discretion to load external config.
Install Mechanism
There is no install spec and no code files (instruction-only), so nothing is written to disk by the skill itself. Requiring the 'gws' binary is the only runtime dependency and is proportionate.
Credentials
The skill declares no required environment variables or primary credential, but managing Google Apps Script normally requires Google credentials. The instructions refer to an external shared SKILL.md for auth, yet that file is not part of this package and its requested credentials are unknown. Absence of declared secrets where they are expected is a red flag.
Persistence & Privilege
The skill does not request always:true and is user-invocable. It does not request persistent presence or modify other skills. No elevated persistence privileges are declared.
What to consider before installing
Before installing: (1) Inspect the referenced ../gws-shared/SKILL.md — it may request or instruct use of Google credentials; do not proceed unless you can review it. (2) Verify the origin and integrity of the 'gws' binary (where it comes from, checksums, vendor). (3) Confirm exactly which Google credentials (OAuth tokens, service account key files, gcloud ADC) the tool will use and where they are stored; ensure least-privilege scopes. (4) Be cautious running the skill if you cannot review the external shared file or the 'gws' binary—run in an isolated environment or container first. (5) If you want to proceed, prefer providing a dedicated, limited-scope service account and avoid reusing broad user credentials.Like a lobster shell, security has layers — review code before you run it.
Plugin bundle (nix)
Skill pack · CLI binary · Config
SKILL.mdCLIConfig
CLI help (from plugin)
gws script --help
latestvk97frqjm84a2rnx5y8hpjnkn3n83y273
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsgws