Skillv0.1.3

ClawScan security

Gsuite Sdk · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignFeb 11, 2026, 4:48 PM

Verdict: benign
Confidence: medium
Model: gpt-5-mini
Summary: The skill's requests and instructions match its stated purpose (accessing Google Workspace via a Python/pip package and OAuth credentials), but there are minor provenance/install metadata inconsistencies you should check before installing or providing credentials.
Guidance: Before installing or using this skill: - Verify the package/source: review the gsuite-sdk package on PyPI and the referenced GitHub repo to confirm the package owner and code are trustworthy. The registry listing has no install spec/source entry, but SKILL.md mentions pip install and a GitHub URL — confirm those match. - Use least-privilege credentials: create OAuth credentials or a service account with only the scopes you need (limit Gmail/Drive/Calendar/Sheets scopes) and avoid using broad/domain-admin credentials. - Understand token persistence: the skill stores refresh/access tokens locally (tokens.db). Those tokens grant ongoing API access — protect that file and be prepared to revoke tokens in Google Console if needed. - Prefer manual review: because this skill is instruction-only and will call Google APIs on your behalf, review the package code (or its GitHub repo) before running pip install or running commands that upload/download data. - Platform behavior: the skill allows autonomous invocation by default (normal), so consider how/when you'll allow the agent to run this skill autonomously. If you cannot verify the package/source or want tighter control, do not install or provide your credentials until you have validated the upstream project.

Review Dimensions

Purpose & Capability: okThe name/description (Google Workspace APIs) aligns with the requested environment variable (GOOGLE_CREDENTIALS_FILE) and the SKILL.md examples (Gmail, Calendar, Drive, Sheets). The operations described (read/send email, list/upload Drive files, read/write Sheets, manage Calendar) are coherent with a gsuite SDK.
Instruction Scope: noteRuntime instructions are narrowly scoped to Google API operations and OAuth authentication. They require a browser-based first-time OAuth flow and note that tokens are persisted locally (tokens.db). This persistence is expected but important to understand because those tokens grant ongoing access to user data.
Install Mechanism: noteThe skill is instruction-only (no install spec in the registry) but the SKILL.md includes a pip install (gsuite-sdk) and an internal metadata block listing a pip install. That inconsistency means the platform may not auto-install the package; you should verify the package on PyPI/GitHub before manually installing.
Credentials: okOnly one env var is required (GOOGLE_CREDENTIALS_FILE), which is appropriate for an OAuth credentials file or service-account JSON. No unrelated secrets or extra credentials are requested.
Persistence & Privilege: okSkill is not always-enabled and uses default autonomous invocation settings. It stores tokens locally (tokens.db) as described, which is normal for OAuth flows. The skill does not request system-wide privileges or modify other skills.