Back to skill
Skillv1.0.12
ClawScan security
Recipe Create Meet Space · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 31, 2026, 6:36 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and runtime instructions align with its stated purpose (creating a Google Meet and emailing the link); nothing requested or instructed is disproportionate, though there are a few small usability/operational notes to be aware of.
- Guidance
- This recipe is coherent: it runs the gws CLI to create a Meet and uses gws gmail to send the link. Before installing, confirm you trust the gws binary (it needs your Google auth/config to actually create meetings and send mail). Replace the hard-coded recipient with the intended address or a parameter to avoid accidental emails. If you do not want the agent to send emails autonomously, consider disabling autonomous invocation for this skill or run it only when manually invoked. The registry/skill metadata mismatch (listed dependent skills in SKILL.md but not in registry metadata) is minor but you may want to ensure the gws-meet and gws-gmail skills are available and trusted.
Review Dimensions
- Purpose & Capability
- okName/description ask for creating a Meet and sharing the link; SKILL.md only invokes a gws CLI to create a space and a gws gmail command to send the link, which is coherent with the stated purpose. Requiring the gws binary is reasonable.
- Instruction Scope
- noteInstructions are narrowly scoped to running two gws commands. Two minor issues: (1) the flow requires manually copying the meeting URI from the command response (not automated), and (2) the example uses a hard-coded recipient (team@company.com) rather than a parameter — this could cause unintended emails if used as-is.
- Install Mechanism
- okNo install spec or code is present (instruction-only skill), so nothing will be downloaded or written by the skill itself. This is low-risk from an install perspective.
- Credentials
- noteThe skill declares no env vars or credentials, which is consistent with being a thin recipe that delegates to the gws CLI. Be aware gws itself likely requires authenticated Google credentials/config on the host; those credentials are not requested by the skill but will be used if present. SKILL.md also lists dependent skills (gws-meet, gws-gmail) that are not recorded in the registry metadata shown — this mismatch is a minor metadata inconsistency.
- Persistence & Privilege
- notealways:false (default), so no forced permanent presence. The skill can be invoked autonomously (disable-model-invocation:false) and its instructions include sending an email — if your agent is allowed to invoke skills automatically it could create a meeting and email recipients without further prompts. This is normal but worth acknowledging.