Google Workspace
Analysis
This skill is not clearly malicious, but it enables broad Google Workspace administration through a third-party CLI with unpinned installation and limited safeguards around destructive actions.
Findings (9)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.
The skill allows instructions returned by the connection flow to guide the agent. That may be purpose-aligned, but returned instructions should not override the user's goal or safety checks.
`| Delete Group | delete-group | Deletes a group from Google Workspace |`
The skill exposes destructive Google Workspace administration actions, but the instructions do not define required approvals, dry-runs, scoping, or rollback handling.
`npm install -g @membranehq/cli@latest`
The skill instructs installing the latest global npm package at runtime. Because it is unpinned, the executed CLI can change over time and is not locked by the provided artifacts.
`npx @membranehq/cli connection get <id> --wait --json`
The skill relies on local CLI execution through npm/npx. This is purpose-aligned for a CLI-based integration, but users should notice that an instruction-only skill still causes executable commands to run.
`Delete Organizational Unit | delete-org-unit | Deletes an organizational unit`
Organizational-unit, group, and user administration can affect many users and resources across a Workspace tenant. The artifacts do not show containment, staging, or recovery controls.
Membrane handles authentication and credentials refresh automatically — so you can focus on the integration logic rather than auth plumbing.
This wording may make sensitive credential handling sound routine. It is not inherently deceptive, but users should still understand the security implications of delegated, refreshable access.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Membrane handles authentication and credentials refresh automatically
The skill relies on delegated authentication and refreshable credentials for Google Workspace through Membrane, but the artifacts do not define OAuth scopes, privilege limits, token lifetime, or revocation steps.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Each result includes `id`, `name`, `description`, `inputSchema` (what parameters the action accepts), and `outputSchema` (what it returns).
Action metadata from the external connection becomes context the agent may rely on when selecting and parameterizing actions. That is expected, but it should not be treated as more authoritative than the user's request.
This skill uses the Membrane CLI to interact with Google Workspace. Membrane handles authentication and credentials refresh automatically
The skill uses Membrane as an intermediary between the agent and Google Workspace for authentication and actions. This is disclosed and purpose-aligned, but it means sensitive credentials and Workspace operations cross a third-party boundary.