Google Workspace
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code, runtime instructions, and environment requirements are consistent with a Google Workspace CLI; required secrets and actions match the stated purpose, with only minor packaging/installation bookkeeping notes to verify before install.
This skill appears to implement exactly what it advertises: a Google Workspace CLI that uses OAuth and encrypts the refresh token with a provided key. Before installing: 1) Confirm you created the OAuth Desktop client in your Google Cloud project and only provide the CLIENT_ID/SECRET to this instance; 2) Provide GOOGLE_WORKSPACE_TOKEN_KEY from a secure secret store so the token at rest is encrypted; 3) If you want maximum assurance, either verify the release checksums in dist/checksums.txt or build the binary from source yourself (go build); 4) Keep Docs/Sheets/Drive in 'off' or 'readonly' unless you deliberately enable readwrite — the binary warns that readwrite requires broad Drive scopes; 5) Note the repo/publish metadata mismatch (no formal install spec in registry) — if you rely on automatic installers, verify how clawhub will obtain and install the binary. If any of these points are unacceptable or unclear, do not install until resolved.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.