Gmail Daily Briefing
v1.1.1Fetch Gmail emails from the last 24h, rank by importance, summarize into bullet points, and auto-create Google Calendar events for detected meetings.
⭐ 0· 89·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the included scripts: fetch_emails.py reads Gmail (Gmail API), create_event.py writes Calendar events (Calendar API). Required binary (python) and Python dependencies in requirements.txt are proportional to the stated functionality.
Instruction Scope
The SKILL.md and agent/instructions.md explicitly instruct the agent to accept a client_secret_*.json upload, write it to the project root, generate an OAuth URL, and instruct the user to paste the redirect URL back. These steps are required for OAuth but involve the agent handling sensitive files (client secret and eventual token.json). The instructions also require the agent to create a local venv and run pip—normal for Python-based skills.
Install Mechanism
No remote downloads or extract steps. The skill is instruction+source included in the package; dependencies are standard google-auth libraries from PyPI (requirements.txt). No unexpected external URLs are used by installers.
Credentials
No environment variables are requested. The skill requires OAuth client credentials (client_secret_*.json) and will create and persist token.json with Gmail readonly and calendar.events scopes—this is appropriate for the described functionality, but these files contain sensitive credentials/tokens and grant the skill access to the user's Gmail and calendar.
Persistence & Privilege
always is false and autonomous invocation is allowed (platform default). The skill stores token.json (and temporary .auth_state.json) in its project directory and auto-refreshes tokens—this is necessary to operate, but means the agent can access Gmail/Calendar when token.json exists. The skill does not request system-wide config changes or other skills' credentials.
Assessment
This skill appears to do what it says, but it requires you to provide Google OAuth credentials and will save an OAuth token (token.json) that lets the skill read your Gmail (readonly) and create calendar events. Before installing: (1) Only upload a client_secret JSON you created in your own Google Cloud project and that you trust the agent with; consider creating a separate project/app for least privilege. (2) Understand token.json grants ongoing access — revoke OAuth access in your Google account if you want to stop access. (3) If you prefer not to share credentials with a remote agent, run the setup locally yourself and only upload the resulting token.json if you trust the agent. (4) Review and test with a non-critical account first. The hardcoded timezone in create_event.py (Asia/Bangkok) and a small sorting bug in fetch_emails.py are functional issues (not security) you may want to adjust.Like a lobster shell, security has layers — review code before you run it.
latestvk97f65gmnm9bcpcefr104rwhjs83kxjq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython