Skillv1.0.14

ClawScan security

Recipe Create Events From Sheet · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 31, 2026, 6:36 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's instructions, required binary, and declared dependencies are coherent with its stated purpose of reading a Google Sheet and creating Google Calendar events.
Guidance: This recipe appears internally consistent, but before installing confirm: (1) you have the 'gws' CLI installed and authorized to access the Google Sheets and Calendar accounts you intend to use; (2) the referenced helper skills (gws-sheets, gws-calendar) are trusted and properly configured; (3) review and test the exact column-to-field mapping to avoid creating incorrect events (the SKILL.md shows example commands but not explicit column mapping); (4) note the skill source is unknown and has no homepage—if you require provenance, ask the publisher for more info or prefer a known-vetted alternative. Also be aware that the agent can run this autonomously (default behavior), so ensure you want an automated action that can create calendar entries.

Purpose & Capability: okName/description match the instructions: the SKILL.md shows reading a spreadsheet and inserting calendar events using the 'gws' CLI and helper skills (gws-sheets, gws-calendar). Requiring the 'gws' binary is appropriate for this recipe.
Instruction Scope: okInstructions only call 'gws sheets +read' and 'gws calendar +insert' for each row; they do not reference unrelated files, system paths, or other credentials. The instructions are minimal (example commands are shown) and do not request data beyond the sheet rows needed to create events.
Install Mechanism: okThis is an instruction-only skill with no install spec and no code files, so nothing is written to disk by the skill itself. That minimizes installation risk.
Credentials: noteThe skill declares no required env vars, which is reasonable because the 'gws' CLI likely manages Google authentication separately. Confirm that the 'gws' binary and the referenced gws-* skills are already authorized with the appropriate Google credentials; that access is necessary for the described functionality.
Persistence & Privilege: okalways is false and the skill does not attempt to modify other skills or global agent settings. It has normal, limited runtime scope.