Skillv1.0.12

ClawScan security

Recipe Schedule Recurring Event · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 31, 2026, 6:37 PM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's requests and instructions align with its stated purpose: it runs the gws CLI to create a recurring Google Calendar event and verify it, and it does not ask for unrelated credentials or perform unexpected actions.
Guidance: This recipe is internally consistent, but before using it: (1) ensure the 'gws' CLI on your system is the legitimate Google Workspace tool and is authenticated only with the scopes you expect (it will create events on your primary calendar); (2) review and edit the event JSON (attendees, times, recurrence) before running to avoid creating unwanted invites; (3) if you are unsure, test on a secondary/calendar or with a test account first; and (4) remember the skill relies on existing gws credentials — revoke or rotate those tokens if you later decide you no longer trust the CLI or skill.

Purpose & Capability: okName/description ask for creating a recurring Google Calendar event. The skill requires the 'gws' binary and the gws-calendar skill, which is consistent with invoking a Google Workspace CLI to manage calendars.
Instruction Scope: okSKILL.md only contains two gws CLI commands: an events insert with event JSON and an agenda listing to verify. It does not instruct reading unrelated files, environment variables, or exfiltrating data to external endpoints. Note: execution will modify the authenticated user's calendar (it uses calendarId 'primary').
Install Mechanism: okInstruction-only skill with no install spec and no code files; nothing is written to disk by the skill itself. This is low-risk from an installation standpoint.
Credentials: noteNo environment variables or credentials are declared, which is reasonable because the skill delegates auth to the 'gws' CLI. Users should be aware that the gws CLI must already be authenticated and its stored credentials/tokens will be used to create calendar events.
Persistence & Privilege: okThe skill is user-invocable and not set to always:true. It does not request persistent/privileged presence or modify other skills' configurations.