Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Gws Skill
v1.0.1Google Workspace admin and investigation tool via service account + domain-wide delegation. Covers Vault (eDiscovery email search), Gmail (read any inbox), D...
⭐ 0· 56·0 current·0 all-time
by@jmac122
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (GWS admin/investigation via service account + DWD) lines up with requested binaries (python3), env vars (service account path, admin email, domain), and the included scripts (vault, gmail, drive, directory, reports, calendar, sheets, docs, people). The requested items are appropriate for the declared purpose.
Instruction Scope
SKILL.md and the scripts only instruct the agent/operator to use the provided Python scripts to call Google Workspace APIs and to impersonate users via domain‑wide delegation. The README explicitly warns about handling raw email content and credentials. There are no instructions to read unrelated system files or to send data to third‑party endpoints.
Install Mechanism
No remote download/install spec is present; this is an instruction + script bundle that requires pip packages from PyPI (google-auth, google-api-python-client) — expected for Google API clients. Nothing is fetched from an untrusted URL or extracted to arbitrary locations.
Credentials
The skill requires a service account JSON key with domain‑wide delegation, an admin email, and domain — these are powerful credentials (they allow reading any user's data) but are exactly what a domain‑wide admin/investigation tool legitimately needs. Treat the key as highly sensitive and limit who can provide it. Declared scopes are read‑only, matching the stated intent.
Persistence & Privilege
always is false and the skill does not request elevated platform privileges or modify other skills. It does suggest a default local key path (~/.config/gws/service-account.json) but does not persist or self‑enable itself beyond reading that file if present.
Assessment
This skill legitimately needs a Google service account JSON key with domain‑wide delegation and an admin email — that key grants the ability to read any user's email, Drive, calendar, etc., so only install and run it in a trusted admin environment. Before installing: (1) Verify you trust the publisher and review the repository on the provided homepage; (2) Ensure the service account was created for this purpose, authorized in Admin Console with only the scopes you expect, and that you store the JSON key securely (chmod 600, limited access); (3) Limit who can invoke the skill and consider not allowing autonomous/unsupervised runs in environments where sensitive data may be exposed; (4) Audit access logs in Google Admin for impersonation activity and rotate/revoke the key if needed; (5) If you have compliance concerns, run the scripts in an isolated environment and review output handling to ensure raw message bodies or attachments are not forwarded outside approved channels.Like a lobster shell, security has layers — review code before you run it.
latestvk9739nyp87gz2398cr4f7aqmyh83n3mz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3
EnvGWS_SERVICE_ACCOUNT_PATH, GWS_ADMIN_EMAIL, GWS_DOMAIN