Recipe Send Team Announcement

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Running the recipe could send messages to a team mailing list and Google Chat space from the configured account.

Why it was flagged

The skill directly instructs use of the gws tool to send an email and post a chat message. This matches the stated purpose, but these commands create real outbound communications if executed.

Skill content

1. Send email: `gws gmail +send --to team@company.com --subject 'Important Update' --body 'Please review the attached policy changes.'`
2. Post in Chat: `gws chat +send --space spaces/TEAM_SPACE --text '📢 Important Update: Please check your email for policy changes.'`

Recommendation

Confirm the recipient address, Chat space, subject, body text, and user approval before executing the send commands.

NoteMedium Confidence

ASI03: Identity and Privilege Abuse

What this means

Messages may be sent under the wrong Google account if gws is configured for an unintended identity.

Why it was flagged

The recipe depends on Gmail and Google Chat integrations through gws, which implies use of whichever Google Workspace identity and permissions are configured for those tools.

Skill content

requires:
  bins:
    - gws
  skills:
    - gws-gmail
    - gws-chat

Recommendation

Check the active gws/Google Workspace account and ensure it is authorized to send the intended announcement.