Back to skill
Skillv1.0.12
ClawScan security
Recipe Review Meet Participants · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 31, 2026, 6:37 PM
- Verdict
- Benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The recipe's requirements and instructions match its stated purpose (using the gws CLI / gws-meet helper to list Google Meet conferences and participants), but it assumes an authenticated gws environment and does not document authentication or credential scope.
- Guidance
- This recipe is internally consistent with its purpose: it tells the agent to run gws (gws-meet) commands to list meetings and participant sessions. Before enabling or running it, verify: (1) the gws binary you have is from a trusted source and you understand how it authenticates; (2) which Google account/workspace and OAuth scopes gws will use — listing conference records and participants may expose sensitive attendee data; (3) the gws-meet prerequisite skill’s behavior and auth flow. Because the SKILL.md does not document authentication, be cautious about installing or running it on systems where gws already has active credentials you don’t want the skill to access.
Review Dimensions
- Purpose & Capability
- okThe name/description (review Meet attendance) aligns with the declared binary requirement (gws) and the prerequisite skill (gws-meet). The CLI commands shown directly implement the stated purpose.
- Instruction Scope
- noteInstructions are narrowly scoped to listing conference records, participants, and participant sessions via the gws CLI. They do not request or reference unrelated files or system paths. However the SKILL.md assumes gws is installed and authenticated and does not include any guidance about required authentication or scopes.
- Install Mechanism
- okThis is an instruction-only skill with no install spec or code files, so nothing is written to disk by the skill itself.
- Credentials
- noteThe skill declares no environment variables or credentials, which is reasonable for an instruction-only recipe. However the gws CLI typically requires Google Workspace credentials or locally-stored auth state; those credentials are not mentioned. Consumers should assume gws will access your Google account/workspace data to list meetings and participants.
- Persistence & Privilege
- okalways is false and the skill is user-invocable. It does not request persistent privileges or attempt to modify other skills or system-wide settings.