Recipe Log Deal Update

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: recipe-log-deal-update Version: 1.0.12 The skill bundle is a standard recipe for logging sales deal updates to Google Sheets using the 'gws' toolset. The instructions in SKILL.md are transparent, align with the stated purpose, and do not contain any indicators of malicious intent, data exfiltration, or unauthorized execution.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If run with the wrong sheet ID or placeholder values, it could add inaccurate information to the sales tracker.

Why it was flagged

The skill instructs use of a tool command that modifies a Google Sheet. This is expected for the stated purpose, but it is still a write action against business data.

Skill content

Append new row: `gws sheets +append --spreadsheet SHEET_ID --range 'Pipeline' --values '["2024-03-15", "Acme Corp", "Proposal Sent", "$50,000", "Q2", "jdoe"]'`

Recommendation

Confirm the target spreadsheet and row values before allowing the append command to run.

Note

ASI03: Identity and Privilege Abuse

What this means

The skill may be able to list matching Drive files, read the target sheet, and append rows using the authenticated Google account.

Why it was flagged

The skill relies on Google Workspace tooling and related Drive/Sheets skills, which means it will operate using whatever Google account and permissions are configured for gws.

Skill content

requires:
      bins:
        - gws
      skills:
        - gws-sheets
        - gws-drive

Recommendation

Use an appropriate Google account with least-privilege access to the intended spreadsheet, and verify that gws is authenticated to the right account.