Back to skill
Skillv1.0.12
ClawScan security
Recipe Create Classroom Course · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 31, 2026, 6:36 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- This is a small, instruction-only recipe that coherently delegates Google Classroom operations to the gws CLI (and the required gws-classroom skill); it does not itself request extra credentials or perform unexpected actions, but it relies on another skill and an external CLI whose permissions you should verify.
- Guidance
- This recipe itself is lightweight and just runs gws CLI commands, which matches its stated purpose. Before installing: (1) confirm you trust the source (no homepage or provenance is provided here), (2) inspect the gws-classroom skill and the gws CLI to see what Google account credentials and OAuth scopes they require (they will need permission to create courses and invite users), and (3) ensure the required gws binary is from a reputable install source. If you cannot verify gws-classroom or gws, avoid granting them Google Workspace admin-level scopes.
Review Dimensions
- Purpose & Capability
- okThe name/description (create a Classroom course and invite students) matches the instructions which run gws classroom commands. Requiring the gws binary and the gws-classroom skill is appropriate for this purpose.
- Instruction Scope
- okSKILL.md only instructs use of gws to create a course, create an invitation, and list students. It does not ask the agent to read unrelated files, exfiltrate data to unknown endpoints, or perform broad system inspection. PLACEHOLDER values (e.g., COURSE_ID) are used correctly.
- Install Mechanism
- okThis is an instruction-only skill with no install spec or code files — minimal risk from installation artifacts.
- Credentials
- noteThe recipe declares no environment variables or credentials itself, which is reasonable for a small wrapper. However it depends on the gws CLI / gws-classroom skill to provide authentication. The gws CLI will require Google account credentials and OAuth scopes to create courses and send invitations — you should confirm what credentials/scopes gws-classroom requests before installing.
- Persistence & Privilege
- okThe skill is not always: true and does not request persistent system-wide privileges. It does rely on an external CLI and another skill but does not modify other skills or agent-wide config itself.