Skill to manage and update google sheet
v1.0.0Read, write, append, and manage Google Sheets via the Google Sheets API (Node.js SDK). Use when you need to interact with spreadsheets — reading data, writing/updating cells, appending rows, clearing ranges, formatting cells, managing sheets. Requires a Google Cloud service account with Sheets API enabled.
⭐ 1· 2.8k·9 current·11 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, SKILL.md, package.json and scripts/sheets.js consistently implement Google Sheets operations via the official googleapis Node.js client. The operations (read/write/format/manage) align with the stated purpose. Minor incoherence: the registry metadata lists no required environment variables or primary credential, while the skill clearly needs a Google service-account JSON key.
Instruction Scope
Runtime instructions in SKILL.md are explicit and scoped to Sheets usage: obtain a service account JSON key, share sheets with the service account email, run npm install and run node scripts/sheets.js <command>. The instructions and the script only reference credential files and paths (cwd and ~/.config/google-sheets) and do not attempt to read unrelated system files or call unexpected endpoints.
Install Mechanism
No remote download/install spec in registry (instruction-only). The repo includes package.json/package-lock.json and instructs to run npm install to fetch googleapis from the public npm registry — a standard, expected dependency for this functionality. No arbitrary URL downloads or archive extraction were found.
Credentials
The skill legitimately requires a Google service account key (private JSON) and checks multiple env var/file locations (GOOGLE_SERVICE_ACCOUNT_KEY, GOOGLE_SHEETS_KEY_FILE, ./service-account.json, ./credentials.json, ~/.config/google-sheets/credentials.json). However, the registry metadata does not declare any required env vars or a primary credential. That mismatch reduces transparency: installing the skill will require you to supply a sensitive JSON key even though the registry listing doesn't advertise it.
Persistence & Privilege
The skill does not request always: true, does not modify other skills or global agent settings, and does not persist credentials beyond normal usage (it reads a key file / env var at runtime). The default autonomous invocation setting is present but not combined with other red flags.
What to consider before installing
This skill appears to do what it says: it uses the official googleapis client to manage Google Sheets. However, the registry listing omitted the fact that the skill needs a Google service-account JSON key (private credentials) and did not name a primary environment variable — the SKILL.md and scripts do require that key. Before installing: 1) Confirm you trust the skill source (homepage is missing and owner ID is unknown). 2) Only provide a dedicated service-account key with the minimal Sheets scope (https://www.googleapis.com/auth/spreadsheets), not broad project permissions. 3) Prefer creating a short-lived or narrowly-scoped service account and rotate/revoke the key after use. 4) Run the skill in an isolated environment (container/VM) if possible. 5) Review scripts/sheets.js yourself (it was included and appears to only call Google APIs) and search for any network calls to non-Google endpoints (none found). If the registry metadata is updated to explicitly declare the required env var(s) and the skill author/publisher can be verified, this assessment would likely change to benign.Like a lobster shell, security has layers — review code before you run it.
latestvk97exe0ed2646tvr4qxcm08agd80b0n2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.