Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Google Workspace CLI reference that exposes sensitive Workspace actions, but those capabilities match its stated purpose and are disclosed as user-run commands.
Install only if you want an agent to help operate your Google Workspace data. Use the narrowest OAuth login that works, avoid --full unless you need broad Workspace access, review email recipients and calendar details before sending or creating events, and keep ~/.config/gws/ protected.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
GOOGLE_WORKSPACE_CLI_TOKEN # Pre-obtained access token (highest priority)
GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE # Path to OAuth credentials JSON
GOOGLE_WORKSPACE_CLI_CLIENT_ID # OAuth client ID
GOOGLE_WORKSPACE_CLI_CLIENT_SECRET # OAuth client secret
The markdown advertises gws calendar +insert and gws gmail +send as helper commands, which can create calendar events and send email on the user's behalf. The file provides examples and auth setup, but does not include any warning or caution about modifying user data, external communication, or verifying recipients/content before execution.
The setup section instructs users to run gws auth login --full for full access and notes that credentials are stored locally, but does not warn that this grants broad access to email, calendars, files, contacts, and other Workspace data. For a markdown skill description covering sensitive user data, omission of any privacy/scope warning is a meaningful disclosure gap.