Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Manage Google Keep notes
v1.0.14Google Keep notes via gkeepapi. List, search, create, manage notes. Add items to notes. Supports authorization via OAuth 2.0 Token.
⭐ 0· 129·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code and docs implement Google Keep operations via gkeepapi (list, search, create, add, archive, delete, pin, etc.), which aligns with the skill name/description. Requiring only python3 (and typical Python packages) is proportionate. The use of authentication helpers (gpsoauth) is consistent with needing account access, but the chosen auth approach is unusual.
Instruction Scope
SKILL.md and README instruct the user to obtain an oauth_token by opening accounts.google.com/EmbeddedSetup, using browser devtools to copy the oauth_token cookie, and pasting it into a generator script — i.e., manual extraction of session cookies. That is nonstandard, sensitive, and could lead to accidental exposure of session cookies or misuse. Instructions also ask the user to write the token to $HOME/.config/gkeep/token.json (plaintext). The runtime commands themselves are limited to gkeepapi operations and local file writes; no remote, arbitrary endpoints are contacted outside Google APIs, but the cookie-extraction step is the key issue.
Install Mechanism
No remote binary downloads or obscure installers: setup uses a Python venv and pip install -r requirements.txt. requirements.txt lists gkeepapi and Google client libraries, which are expected. No extract-from-URL installs or unusual third-party downloads are present.
Credentials
The skill declares no required environment variables and only optionally reads GKEEP_PASSWORD in login flow, which is reasonable. However the skill requires manual handling of a master token/session cookie and storing it in a local token.json; that storage is sensitive and not called out in the registry metadata. The number of secrets requested is small and relevant, but the method of obtaining the token (manual cookie copy or master login) is disproportionate compared to standard OAuth flows and increases risk of accidental credential disclosure.
Persistence & Privilege
always:false and user-invocable:true (normal). The skill creates a venv in its workspace and writes a token file to $HOME/.config/gkeep/token.json; it does not request persistent system-wide privileges nor modify other skills. Storing a valid auth token locally grants broad access to the user's Google account until revoked, so the token file should be treated as a high-privilege artifact.
What to consider before installing
This skill appears to do what it claims (manage Google Keep) but its authentication guidance is nonstandard and risky. It tells you to copy a browser oauth_token cookie and paste it into a token file — doing so may expose a session token that can be used to access your Google account. Before installing or using it: (1) review the generate_token.py and gkeep.py code yourself or with someone you trust; (2) prefer an official OAuth client flow (google-auth-oauthlib) instead of copying cookies or using gpsoauth if possible; (3) if you must use this skill, store token.json with restrictive permissions (the script does set 0o600 on login path, but manual token creation may not), keep backups out of sync, and revoke the token from your Google account if you stop using the skill; (4) verify the gpsoauth library and the repo source (the listed homepage should be reviewed) and avoid pasting secrets into untrusted terminals or editors. If you are uncomfortable with manual cookie extraction or a nonstandard auth path, do not install the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk97a13xb858n7qy1wekk1f60q183ff2t
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📝 Clawdis
Binspython3