Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Recipe Create Feedback Form

v1.0.12

Create a Google Form for feedback and share it via Gmail.

0· 417·9 current·9 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (create a Google Form and share via Gmail) aligns with the instructions, which call the 'gws' CLI to create a form and send an email. Declared dependency on the 'gws' binary and the gws-forms / gws-gmail skills is coherent.
!
Instruction Scope
Instructions are narrowly scoped to creating a form and emailing a link, but they include a hard-coded recipient (attendees@company.com) and rely on the agent to extract and substitute the responderUri into the email body. There are no safety checks, confirmation steps, or guidance about verifying recipients or content before sending.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest-risk install footprint. It correctly lists 'gws' as a required binary rather than attempting to download or install arbitrary code.
Credentials
No environment variables or credentials are declared. However, sending email and creating Google Forms normally require authenticated access; the skill assumes the 'gws' CLI or referenced skills contain or manage authentication. The lack of any declared auth requirement or guidance about how credentials are provided is a notable omission.
Persistence & Privilege
Skill is not always-enabled and does not request elevated persistence. It is user-invocable and can be invoked autonomously (platform default) but does not request system-wide config changes.
What to consider before installing
This recipe looks like a straightforward wrapper around your local 'gws' CLI to create a Google Form and email its link, so it is generally coherent — but check two things before installing/using it: (1) authentication: verify how the 'gws' binary is authenticated (OAuth credentials/token) and ensure no undocumented secret handling is required, and (2) recipients: the SKILL.md will send the form to attendees@company.com by default — confirm that address is correct and that you want an automated send (consider adding a confirmation step or editing the recipient). Also test the commands in a safe environment first to confirm the responderUri substitution and that the email content is what you expect.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binsgws
latestvk9771hhffx431fg7myye460wts83zsxd
417downloads
0stars
13versions
Updated 6h ago
v1.0.12
MIT-0

Create and Share a Google Form

PREREQUISITE: Load the following skills to execute this recipe: gws-forms, gws-gmail

Create a Google Form for feedback and share it via Gmail.

Steps

  1. Create form: gws forms forms create --json '{"info": {"title": "Event Feedback", "documentTitle": "Event Feedback Form"}}'
  2. Get the form URL from the response (responderUri field)
  3. Email the form: gws gmail +send --to attendees@company.com --subject 'Please share your feedback' --body 'Fill out the form: FORM_URL'

Comments

Loading comments...