Google Sheet API

OpenClaw skill that installs a Google Sheets CLI with setup steps and commands for read/write, batch, formatting, and sheet management.

Security Scan

The skill is internally consistent with a Google Sheets CLI: its code, docs, and behavior match the described purpose and it legitimately requires service-account credentials to operate.

Purpose & Capability

Name, description, SKILL.md, package.json, and scripts/sheets-cli.js all implement a Google Sheets CLI (read/write/batch/format/sheet management) and the requested dependencies (googleapis) are appropriate.

Instruction Scope

Runtime instructions are focused on installing and running the CLI and on providing service-account credentials; they do not instruct the agent to collect unrelated system data or post to unexpected endpoints.

Install Mechanism

There is no registry install spec; SKILL.md directs users to run npm install which pulls a standard dependency (googleapis) from npm — expected for a Node CLI.

Credentials

The skill legitimately requires Google service-account credentials (multiple env var and file-path options are documented). Registry metadata lists no required env vars, which is a minor mismatch with the SKILL.md and runtime behavior. The tool searches common local paths (including the user home path), so it may pick up credentials from the working directory or ~/.config automatically — this is convenient but could result in using an unexpected key if multiple credentials exist. There is a small inconsistency in an env var name in code (GOOGLE_SERVICE_ACCOUNT_JSON) that isn't documented in SKILL.md.

Persistence & Privilege

The skill is not always-enabled, does not request elevated platform privileges, and does not modify other skills or system-wide agent settings.

Assessment

This skill appears to be a legitimate Google Sheets CLI that requires a Google service account key. Before installing: (1) Only provide a service-account JSON you control and never commit it to source control; (2) be aware the CLI will look for credential files in the current directory and in ~/.config, so run it in a controlled folder or set the explicit env var (e.g., GOOGLE_SERVICE_ACCOUNT_KEY or GOOGLE_SHEETS_CREDENTIALS_JSON) to the intended path/inline JSON; (3) review scripts/sheets-cli.js yourself if you want to confirm it doesn't contact any non-Google endpoints; (4) run npm install in an environment where pulling googleapis from npm is acceptable. The main issues are a small metadata/documentation mismatch about required env vars and a minor env-var name inconsistency — these are not indicators of malicious behavior but you should confirm which credential the CLI will actually use on your system.

Google Sheets API Skill (Advanced)

Purpose

Provide a production-ready Google Sheets CLI for OpenClaw. This skill supports data reads/writes, batch operations, formatting, and sheet management with service account authentication.

Best fit

• You need a repeatable CLI for automation tasks.
• You want JSON-in/JSON-out for pipelines.
• You need more than basic read/write (formatting, sheet ops, batch updates).

Not a fit

• You must use end-user OAuth consent flows (this skill is service-account focused).
• You only need lightweight, one-off edits.

One-time setup

1. Create or select a Google Cloud project.
2. Enable the Google Sheets API.
3. Create a service account and download its JSON key.
4. Share target spreadsheets with the service account email.

Install

cd google-sheet-api
npm install

Run

node scripts/sheets-cli.js help
node scripts/sheets-cli.js read <spreadsheetId> "Sheet1!A1:C10"
node scripts/sheets-cli.js append <spreadsheetId> "Sheet1!A:B" '@data.json'

You can also use npm:

npm run sheets -- read <spreadsheetId> "Sheet1!A1:C10"

Credentials

Supported sources (first match wins):

• GOOGLE_SHEETS_CREDENTIALS_JSON (inline JSON string)
• GOOGLE_SERVICE_ACCOUNT_KEY (file path)
• GOOGLE_SHEETS_KEY_FILE (file path)
• GOOGLE_APPLICATION_CREDENTIALS (file path)
• ./service-account.json, ./credentials.json, ./google-service-account.json
• ~/.config/google-sheets/credentials.json

Input conventions

• JSON values can be inline or loaded from file using @path.
• Write/append expect a 2D array of values.

Example data.json:

[["Name","Score"],["Alice",95]]

Command map (high level)

Data:

• read, write, append, clear, batchGet, batchWrite

Formatting:

• format, getFormat, borders, merge, unmerge, copyFormat

Layout:

• resize, autoResize, freeze

Sheets:

• create, info, addSheet, deleteSheet, renameSheet

Advanced:

• batch (raw spreadsheets.batchUpdate requests)

Operational guidance

• Prefer read-only scope for read workflows when possible.
• Add retry with exponential backoff for 429 and transient 5xx errors.
• Keep request payloads small to avoid limit issues.

Expected output

• JSON to stdout; non-zero exit code on errors.

Security notes

• Never log or commit service account keys.
• Share spreadsheets only with the service account email required by this skill.