Gws Classroom

Google Classroom: Manage classes, rosters, and coursework.

Security Scan

The skill's declared purpose (manage Google Classroom via a gws CLI) is plausible, but it hides how authentication is performed (delegating to a referenced ../gws-shared SKILL.md) and declares no credentials or config paths — an inconsistency that could obscure where Google credentials live or how they're used.

Purpose & Capability

Name and description align with requiring a 'gws' CLI binary to operate against Google Classroom APIs. Requiring a CLI named 'gws' is coherent for a wrapper that talks to Google Workspace Classroom.

Instruction Scope

Runtime instructions are an instruction-only CLI wrapper that call 'gws classroom <resource> <method> [flags]'. However the SKILL.md explicitly delegates auth and global flags to ../gws-shared/SKILL.md and suggests running 'gws generate-skills' if missing — this means the skill's runtime behavior depends on external shared config or generated files not included here. That delegation is reasonable for a CLI ecosystem but creates opaque behavior because auth/config steps are not present in this skill's files.

Install Mechanism

No install spec and no code files are present; the skill is instruction-only and relies on an existing 'gws' binary on PATH. This is the lowest-risk install model for a CLI-based skill — the main risk is the origin and behavior of the external 'gws' binary, which this package does not provide or verify.

Credentials

The skill declares no required environment variables or primary credential, yet its runtime depends on authentication described in a separate ../gws-shared SKILL.md. That creates an opacity gap: the skill may require Google OAuth tokens, service-account keys, or other secrets via the shared config or via the 'gws' binary, but does not declare them here. Absence of declared credentials is disproportionate to the Classroom management functionality, which normally requires account credentials or OAuth scopes.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It does instruct the operator to run 'gws generate-skills' if a shared SKILL.md is missing; that command may create files (auth/config) on disk. This is expected for a CLI integration but means the skill's behaviour depends on file writes outside this package.

What to consider before installing

This skill is a thin wrapper that expects an external 'gws' CLI and a separate '../gws-shared/SKILL.md' to provide authentication. Before installing or invoking it: 1) Verify the provenance and integrity of the 'gws' binary (where it comes from, release site, checksums). 2) Inspect any existing ../gws-shared/SKILL.md or the files created by 'gws generate-skills' to see what credentials or tokens will be stored and where. 3) Do not provide Google service account keys or broad OAuth scopes unless you trust the gws implementation and have reviewed the auth flow and scopes requested. 4) If you cannot inspect the gws binary or the shared SKILL.md, treat this skill as potentially opaque and run it in a restricted/sandboxed environment or avoid installing it.

classroom (v1)

PREREQUISITE: Read ../gws-shared/SKILL.md for auth, global flags, and security rules. If missing, run gws generate-skills to create it.

gws classroom <resource> <method> [flags]

API Resources

courses

• create — Creates a course. The user specified in ownerId is the owner of the created course and added as a teacher. A non-admin requesting user can only create a course with themselves as the owner. Domain admins can create courses owned by any user within their domain. This method returns the following error codes: * PERMISSION_DENIED if the requesting user is not permitted to create courses or for access errors. * NOT_FOUND if the primary teacher is not a valid user.
• delete — Deletes a course. This method returns the following error codes: * PERMISSION_DENIED if the requesting user is not permitted to delete the requested course or for access errors. * NOT_FOUND if no course exists with the requested ID.
• get — Returns a course. This method returns the following error codes: * PERMISSION_DENIED if the requesting user is not permitted to access the requested course or for access errors. * NOT_FOUND if no course exists with the requested ID.
• getGradingPeriodSettings — Returns the grading period settings in a course. This method returns the following error codes: * PERMISSION_DENIED if the requesting user isn't permitted to access the grading period settings in the requested course or for access errors. * NOT_FOUND if the requested course does not exist.
• list — Returns a list of courses that the requesting user is permitted to view, restricted to those that match the request. Returned courses are ordered by creation time, with the most recently created coming first. This method returns the following error codes: * PERMISSION_DENIED for access errors. * INVALID_ARGUMENT if the query argument is malformed. * NOT_FOUND if any users specified in the query arguments do not exist.
• patch — Updates one or more fields in a course. This method returns the following error codes: * PERMISSION_DENIED if the requesting user is not permitted to modify the requested course or for access errors. * NOT_FOUND if no course exists with the requested ID. * INVALID_ARGUMENT if invalid fields are specified in the update mask or if no update mask is supplied.
• update — Updates a course. This method returns the following error codes: * PERMISSION_DENIED if the requesting user is not permitted to modify the requested course or for access errors. * NOT_FOUND if no course exists with the requested ID. * FAILED_PRECONDITION for the following request errors: * CourseNotModifiable * CourseTitleCannotContainUrl
• updateGradingPeriodSettings — Updates grading period settings of a course. Individual grading periods can be added, removed, or modified using this method. The requesting user and course owner must be eligible to modify Grading Periods. For details, see licensing requirements.
• aliases — Operations on the 'aliases' resource
• announcements — Operations on the 'announcements' resource
• courseWork — Operations on the 'courseWork' resource
• courseWorkMaterials — Operations on the 'courseWorkMaterials' resource
• posts — Operations on the 'posts' resource
• studentGroups — Operations on the 'studentGroups' resource
• students — Operations on the 'students' resource
• teachers — Operations on the 'teachers' resource
• topics — Operations on the 'topics' resource

invitations

• accept — Accepts an invitation, removing it and adding the invited user to the teachers or students (as appropriate) of the specified course. Only the invited user may accept an invitation. This method returns the following error codes: * PERMISSION_DENIED if the requesting user is not permitted to accept the requested invitation or for access errors.
• create — Creates an invitation. Only one invitation for a user and course may exist at a time. Delete and re-create an invitation to make changes. This method returns the following error codes: * PERMISSION_DENIED if the requesting user is not permitted to create invitations for this course or for access errors. * NOT_FOUND if the course or the user does not exist. * FAILED_PRECONDITION: * if the requested user's account is disabled.
• delete — Deletes an invitation. This method returns the following error codes: * PERMISSION_DENIED if the requesting user is not permitted to delete the requested invitation or for access errors. * NOT_FOUND if no invitation exists with the requested ID.
• get — Returns an invitation. This method returns the following error codes: * PERMISSION_DENIED if the requesting user is not permitted to view the requested invitation or for access errors. * NOT_FOUND if no invitation exists with the requested ID.
• list — Returns a list of invitations that the requesting user is permitted to view, restricted to those that match the list request. Note: At least one of user_id or course_id must be supplied. Both fields can be supplied. This method returns the following error codes: * PERMISSION_DENIED for access errors.

registrations

• create — Creates a Registration, causing Classroom to start sending notifications from the provided feed to the destination provided in cloudPubSubTopic. Returns the created Registration. Currently, this will be the same as the argument, but with server-assigned fields such as expiry_time and id filled in. Note that any value specified for the expiry_time or id fields will be ignored.
• delete — Deletes a Registration, causing Classroom to stop sending notifications for that Registration.

userProfiles

• get — Returns a user profile. This method returns the following error codes: * PERMISSION_DENIED if the requesting user is not permitted to access this user profile, if no profile exists with the requested ID, or for access errors.
• guardianInvitations — Operations on the 'guardianInvitations' resource
• guardians — Operations on the 'guardians' resource

Discovering Commands

Before calling any API method, inspect it:

# Browse resources and methods
gws classroom --help

# Inspect a method's required params, types, and defaults
gws schema classroom.<resource>.<method>

Use gws schema output to build your --params and --json flags.